Quoting Nick Drage <nickd@xxxxxxxxxxxxxxxxx> Date: Sat, 28 Aug 2004 01:44:36 > Out of interest, why only permit packets with a source port of 1024 and > above? This rule might not pass DNS requests if they come from a local > DNS server being used internally, if it's set up with a "query-source" > of port 53. Also the use of source ports is OS dependant, so if you're > going to watch this why not pick the range the OS uses? The range of > your Linux system can be found via Good question... Probably just a habit ;-) Safe to use restriction without having to worry about OS specifics. As for query-source, options in BIND 9 for forcing sport to 53 are there mainly as workarounds for people that have to live with old firewall configurations and old assumptions. Something that most new installations really don't need. I wouldn't be suprised at all to see those options go away one day in future. -- Aleksandar Milivojevic <amilivojevic@xxxxxx> Pollard Banknote Limited Systems Administrator 1499 Buffalo Place Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7
