Firewall blocking NSlookups

[agentflicker]

Hello all,

I've a problem with a new firewall I've built to replace our old one. The old firewall is NT40 Firewall-1 ver 4.0 build 4066. The new firewall is NT40 firewall-1 ver 4.0 build 4205. Apart from the different build numbers both firewalls are identical.

When I plug in the new firewall though I cannot do any NSlookups or DNS resolution, so my email server can't send any email. I put in a rule so I could log DNS traffic and can see some sometimes being accepted - but not when I do a NSlookup, I can't even see it being dropped or rejected.

Unfortunatly I can't find the old 4066 patch to double check that this is the problem. Any one got any ideas?

Thanks Simon.

 

[mavenccie]

Are you seeing any drops in the logs? If so, what rule?
I would check in the properties setup on the Security Policy tab for an unchecked "Accept Domain Name UDP..." and "Accept Domain Name TCP...". You might have had these checked in the previous firewall. DNS UDP is for resolving and TCP is for zone transfers.
You can either check these depending on what you need. Or you can leave unchecked then only allow DNS traffic to specific DNS servers outside of the Internal LAN. I would create the rule dependent on how your DNS is architected. My rule of thumb is only allow specifically what should be leaving/coming from my network.

 

[yizhar]

HI!

What DNS server do you have, internal or external to the FW?

If you have an internal DNS server, try to configure it with the ISP DNS servers as forwarders.

I don't know if it can help, but it's easy to try.

Bye

Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[agentflicker]

Thanks for your help everyone. I've sorted it out now.

I had to clear the arp cache on the router external to the firewall. The router got the new mac address of the external firewall interface but did not for static NATed addresses, so I could browse and do everything fine that didn't require a static nat (ie just hidden addresses) but because our internal DNS server had a NAT the DNS replies could not find a return path.

Simon.