Access-List DNS

[vmolinaro]

When writing an access-list to allow DNS should I allow only UDP or both UDP/TCP? I have no requirement to allow any zone transfers and so I guess allowing TCP would not be necessary. Would just like to confirm.

Vito

[mostiguy]

tcp is necessary for any replies over 512bytes. My experience has been that for windows centric environments, allowing tcp is a good thing (even though I block zone transfers).

[vmolinaro]

Thanks.

How do you block zone transfers on the firewall if you allow TCP? I assume you mean this is done on the DNS server itself.

Thanks

[mostiguy · Accepted solution]

what dns server are you running? on win2k, you right click the server name in the DNS mmc snapin, and it is on one of the tabs

[vmolinaro]

The server is setup by the client and so I will have them check their configuration.

Thanks for answering my questions

Vito