- This question relates specifically to hardening the configuration of DNS, firewalls and at the limit, ntp. (not proxys, http access,vpn's or other services).
- This is about the externally-facing side of the network. DNS clients are locally connected inside on a separate interface card of the dns server. I just want to remove my DNS server's clients or other internal stuff from the equation.
- Trying to open the least amount of ports and restrict the open ports as much as possible anywhere in the stack (by tcp/udp, source/dest port....).
- My biggest concern is that from my understanding, my DNS server queries to other DNS servers can be made with a source port between 1024 and 49152, but I do not want to open all those ports.
- The firewall is using "masquerade" (NAT).
- DNS is using dns-sec.
- Security is the priority over a slower response time.
- If you can provide an answer with the least amount of ports/protocols etc ... (including "obvious" ports), aka smallest attack surface that must be open for the DNS to communicate to other servers and why that is, that would be most helpful.
As FirewallD is a newer front end in the *nix world, any example that might use FirewallD (rather than straight iptables or pf) would be of additional value.
This is essentially a general question, but terms of my context, I have common standard applications: an RHEL-family linux server with bind DNS, Squid Proxy, and firewallD firewall, all in the same machine, facing the external internet.
I have looked around and see a number of specific questions that are dependent on specific software or fixing a problem. This question relates more to approach and security than specific applications. Thanks in advance for your time.
Using Bind it's possible to limit the set of source ports used for a query. DNSSec aside, restricting the source port too much makes it easier for fake replies to be injected.
If you want to lock down entirely, you could use an external proxy such as Google's 220.127.116.11 DNS servers on 18.104.22.168. Single (internal) source. Single destination for all queries. I can't advise on the DNSSec aspect for this, though.
The reference NTP implementation uses port 123 for source and destination, but not every implementation does so. Unless you control the upstream server you're not yet going to get a security pairing, so you need to be able to reach servers that are "sufficiently" trusted. Ideally three or five. Certainly not just two ("they're different, but which one's wrong"). It's very easy to find Stratum 3 servers. Not too hard to find Stratum 2s, and if you look it's possible to find public access Stratum 1s. (Or you could just run your own GPS based receiver. They're not excessively expensive these days.)