Topic: Open Port 53 for public DNS in SME7

[centreit]

Help.....

I have been trying for some days now to open port 53 on my firewall to allow public DNS access to my server. I have tried the following:

created a 2nd tinydns service called tinydnsext by "/sbin/e-smith/tinydns-conf tinydnsext dnslogext /var/service/tinydnsext 10.11.12.13" (where 10.11.12.13 is my public ip) and added a link in the /service directory

Added appropriate users for tinydnsext (tinydnsext and dnslogext)

Set the first tinydns service to run on 127.0.0.1 and dnscache to run on 192.168.6.1 (internal ip)

Allowed public access to port 53 for tinydnsext by "/sbin/e-smith/config set tinydnsext service access public status enabled UDPPort 53"

Tinydnsext appears to work ok, nmap states that port 53 is open|filtered and when a DNS request gets to my server the firewall blocks it and I get the following in my iptables log file:

          2006-02-07 09:21:46.159993500 Feb  7 09:21:36 server denylog: IN=eth1 OUT= MAC=00:04:61:4c:5f:78:00:0f:b5:33:14:30:08:00  SRC=66.36.241.109 DST=10.1.1.2 LEN=65 TOS=00 PREC=0x00 TTL=117 ID=5829 PROTO=UDP SPT=59942 DPT=53 LEN=45

Information on opening ports in SME7 seems rather scarce, can someone please help me out???


Thanks heaps,

Daniel Davis

[centreit]

OK I have almost worked it out. It seems that even though tinydns and dnscache are set to the correct interfaces in the db (localhost and private respectively) when the /etc/rc.d/init.d/masq template is expanded these services are set to listen on the external interface.

Is anybody able to help explain why this happens?

Thanks,

Daniel Davis

[netix]

go in /etc/e-smith/templates/etc/rc.d/init.d/masq
edit 41AllowDHCPC (if you dont use dhcp )

Code: [Select]


{
           $OUT .= <<'HERE';
    /sbin/iptables --append INPUT -p udp --dport 53 -i $OUTERIF -j ACCEPT
HERE

}


and finish it with
signal-event remoteaccess-update
service masq restart

or make custom template

[CharlieBrady]

Information on opening ports in SME7 seems rather scarce, can someone please help me out???

You appear to have missed this:

http://no.longer.valid/phpwiki/index.php/SME7FAQs

Unless you really understand DNS, I'd strongly advise you to let someone else publish it.