Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

return traffic acl issues

I have a 1721 router at home as my gateway to the internet and firewall, running fw ios 12.3.22. i have 5 static ips and currently using 2 internal networks each one on a different public ip. i have overloaded nat set up and the actual ip on the internet facing interface is in the middle of my range and at the moment not in use. the problem im having is return udp traffic. I do not want to permit everything inbound on the wan side so i set up an access list to allow the inbound traffic i needed and return udp traffic. The problem so far has been DNS. When i looked at the logged blocks it looks like the return dns traffic is going to a different port then 53. I am guessing this is due to the natting but i do not know what the best way to get around this is. i have the permit any any eq 53 but because the retrun traffic seems to be coming in on a different port.

7 REPLIES
New Member

Re: return traffic acl issues

Do you have DNS inspection enabled?

If you want to permit return DNS replies through your WAN ACL you need to have an ACL entry like the following:

permit udp any eq domain any

or

permit udp host x.x.x.x eq domain any

New Member

Re: return traffic acl issues

i have a line in there

access-list 101 permit udp any any eq 53

I had the denied traffic loged and the dest. port on the return dns querys wasnt port 53

New Member

Re: return traffic acl issues

that ACL line does not apply to return UDP DNS replies, it will allow inbound UDP DNS resolution requests

New Member

Re: return traffic acl issues

so the acl for any return udp traffic would be

permit udp any eq any?

Green

Re: return traffic acl issues

Yes, palomoj has this right. The return traffic would have a source port of 53 and a destination port of any.

New Member

Re: return traffic acl issues

Thank you very much. I am still kinda new at this and i really appreciate you guys helping me out. Also just out of curiosity is their any way to make all blocked ports not respond instead of responding as closed or blocked(to stealth them)

Gold

Re: return traffic acl issues

590
Views
0
Helpful
7
Replies
CreatePlease to create content