https://inliniac.net/blog/tag/dns/ Recent content in Dns on Inliniac Hugo en Fri, 25 Jul 2008 21:50:59 +0000 https://inliniac.net/blog/2008/07/25/support-for-source-port-randomization-in-vuurmuur/ Fri, 25 Jul 2008 21:50:59 +0000 https://inliniac.net/blog/2008/07/25/support-for-source-port-randomization-in-vuurmuur/ <p>One of the workarounds for the current DNS problems is that servers introduce source port randomization.  So it&rsquo;s time for you to patch your DNS server so it uses random source ports. If for some reason you are unable to do that, iptables can help. Michael Rash has a good write up of how that works <a href="http://cipherdyne.org/blog/2008/07/mitigating-dns-cache-poisoning-attacks-with-iptables.html">here</a>.</p> <p>In Vuurmuur there is now a per rule option, that can be enabled for the SNAT, MASQ, PORTFW, DNAT and BOUNCE actions, called &lsquo;random&rsquo;. This passes the &lsquo;&ndash;random&rsquo; option to the iptables rules Vuurmuur creates. Note that you need a recent distro for this. Debian Etch is too old, Ubuntu Hardy is fine. The new functionality is just released in Vuurmuur 0.5.74 alpha 6. Check it out!</p>