Re: Which port(s) to allow through for DNS server

[Onno Kreuzinger]

Zitiere Tony Rall <[EMAIL PROTECTED]>:

> 
> I fairly strongly disagree.  If you block below 1024 you will be
> blocking
> lots of legitimate queries.  Bind itself used to default to 53 as its
> source port.
> 
 Just to add some confusion, akaik:

client -> server 
>1024     53     (Query)    UDP if size below 512, else TCP     
response reuses same ports/protocoll

server  -> server
53         53        UDP for fowarded queries, TCP for zone-transfers
respose reuses same port/protocoll


please correct this if its wrong !!


regards

Onno Kreuzinger



-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]