Configuring DNS Support

Configuring DNS Support

Use the DNS option on the static command to create a one-to-one address translation only if the reply is a DNS reply. Use the no form of the command to remove the translation.

Pix(config)# static (hi_interface, lo_interface) global_ip local_ip [dns] [netmask mask]
[norandomseq] [max_conn [em_limit]]
Pix(config)# no static (hi_interface, lo_interface) global_ip local_ip [dns] [netmask mask]
[norandomseq] [max_conn [em_limit]]

The following output is an example of creating the translation for a DNS server in the network depicted in Figure 19-13.

Pix(config)# static (dmz, outside) 1.1.1.3 192.168.128.3 dns 

Figure 19-13: Static translation for a DNS server on a DMZ network

Because of the high number of attacks on DNS services, PIX Firewalls now only allow the first DNS reply to pass through, and then they drop all others. This prevents man in the middle attacks, where the attacker sends a second DNS reply, creating a bogus domain name resolution that would direct the browser to the wrong site. Unfortunately, DNS service would accept the later reply and update its table.

The following static PAT translation would direct any DNS traffic directed to the PIX Firewall outside interface to be redirected to the inside DNS server at 192.168.128.3.

Pix(config)# static (dns, outside) udp interface domain 192.168.128.3 domain
cp19 Access Control Lists