Source ports for DNS query

[Karen Leung]

What is the range of source ports that BIND uses to make DNS query to the Root DNS?

Here are the system info:

HP-UX 11.0
BIND 8.2.5-REL

[Scott Van Kalken]

port 53 tcp and udp

udp for queries and tcp for transfers.

[Michael Tully]

If DNS is to resolved other than locally, I'm sure it uses port 53. Have a look in /etc/services

domain 53/tcp nameserver # Domain Name Service
domain 53/udp nameserver #

[U.SivaKumar_2]

Hi,
Old versions of BIND made DNS resolution queries by attaching to port 53 of the remote nameserver and receiving replies back on port 53 as well. The new software connects to port 53, but the back-channel for data is designated as a random channel at port 1023 or higher. This presents a problem for sites that are filtering UDP traffic on port 1023 or higher.
Most "older" firewalls will have ports 1023 and higher filtered as a matter of course. This will result in resolvers using BIND 8.1.1 not being able to get proper name resolution for sites behind those firewalls. This impacts customers using Allegiance Internet name resolvers, since those name servers will not be able to query the remote site about the names in question, and will time out.

If you are running a firewall and nameservers, it is necessary to remove UDP filtering for your nameserver from not only port 53 but 1023 and higher.

regards,
U.SivaKumar

[Karen Leung]

Thanks a lot for all your replies.

My concern is the SOURCE port range that the DNS uses when it makes a DNS query addressed to destination port 53 of another nameserver.

The situation is that the local DNS has to traverse an access-list-defined router when making DNS query to another nameserver. In order to define a valid access list, the source port range has to be defined for the rule allowing DNS traffic from my local DNS to the remote nameserver.

[sven verhaegen]

unfortunately the source port is lkie most proceses a assigned number out of the free socket ports , only the direction port of the packet goes to a well known bind port e.g 53/udp or tcp so any adress going up from 1024 could be used

[Steven Sim Kok Leong]

Hi,

Even though BIND 8.X.X uses ephemeral ports above 1023 by default, they can also be configured to use port 53 to emulate the behaviour of BIND 4.X.X (udp/53 for queries/replies between DNS servers and tcp/53 for zone transfers).

Once configured, you only need to open up UDP/53 and TCP/53 at your firewall.

Hope this helps. Regards.

Steven Sim Kok Leong

[Steven Sim Kok Leong]

Hi,

To add on, you just need to modify your named.conf. Below is an extract from BIND 8.1 but I believe it is the same in BIND 8.2.5:

options {
...
/*
* If there is a firewall between you and nameservers you want
* to talk to, you might need to uncomment the query-source
* directive below. Previous versions of BIND always asked
* questions using port 53, but BIND 8.1 uses an unprivileged
* port by default.
*/
// query-source address * port 53;
...
}

Hope this helps. Regards.

Steven Sim Kok Leong

[rick jones]

I am reasonably certain that the resolver library will use anonymous/ephemeral ports as the source for its DNS queries. One way to verify this on 11.X is to take a copy of tusc from ftp.cup.hp.com, and perform a verbose tusc trace of an application that calls gethostbyname over and over again. If you see no calls to bind before the query is sent, or if you see calls that have "0" as the port number, anonymous or ephemeral ports are being used.

Of course, you can also get a copy of tcpdump (www.tcpdump.org) and sniff the packets being sent on the wire.

I went grepping through the output of "strings" on the libraries in /usr/lib and did not find a query-source string in them. i could find "nameserver" and "domain." I also tried adding that query-source line to the /etc/resolv.conf file on my 11.0 system, and tcpdump still showed queries sourcing from ephemeral ports.

I did a less comprehensive check on 11.11 and had the same results. If you need to restrict queries to a specific port range it seems an enhancement request submitted through the response centre in in order

Or in your access list router, tell it to allow traffic to port 53 on the outside from any port in the ephemeral range. Under HP-UX 11, the default ephemeral range is 49152 to 65535. The ndd tunables tcp_largest_anon_port and tcp_smallest_anon_port control the boundaries of that range.

[Steven Sim Kok Leong]

Hi,

You have to add query-source to named.conf, NOT resolv.conf.

In addition, named.conf is meant for configuring your DNS server which is running BIND named for queries or zone transfers to other DNS servers. It is NOT meant for clients which are not running BIND (i.e. named daemon) and which are simply performing simple nslookup name queries.

The question is about DNS server query to root server, NOT client query to DNS server.

Hope this helps. Regards.

Steven Sim Kok Leong

[rick jones]

oops...