forward port 53 to internal dns server using pdm pix 501

[wlanman]

Hi everyone! I am a total newbie when it comes to dealing with Pix Firewalls. I just bought one right and i plugged it into my cable modem and i want to be able to forward any dns requests to my internal dns server (192.168.1.4). I was using a cisco 2514 with the ip nat inside source static.... comand to forward all needed ports to my internal boxes, but i just can figure out how this damn PDM works. Can anyone please tell me how to do this? Thanks in advance for all the help. Below is a copy of my sh ru

Building configuration...
: Saved
:
PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfirewall
domain-name ciscopix.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
pager lines 24
interface ethernet0 10baset
interface ethernet1 10full
mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet timeout 5
ssh timeout 5
dhcpd address 192.168.1.15-192.168.1.20 inside
dhcpd dns 24.25.227.34 24.25.227.35
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd domain localhawaii.com
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:2367cf80a790affeb8a3f11a26b4cbb2
: end
[OK]

Mahalo Nui Loa

 

[snootalope]

I'd have an answer for you easily, but I'm a little confused on why your outside interface is set to use DHCP?

what I would of said was.. in your config, do a:

static (inside,outside) tcp xxx.xxx.xxx.xxx domain 192.168.1.4 domain netmask 255.255.255.255

then setup an acl/permission to allow that to flow to your dns box..

where xxx.xxx.xxx.xxx is the address of your external interface, but like I said, if it's dhcp, I think that would make it a real pain in the arse for you..
************************************
I'm just curious, what kind of cable modem did you buy and do those now come with any kind of Web Management software built in??

"tis better to remain silent and be thought of as a fool..
then open your mouth and remove all doubt" Mark Twain

"I should of been a doctor.." Me

 

[wlanman]

Snoop,

The cable modem was provided by my broadband service provider so i didnt have to buy it. And it is not managable whatsoever. This pix not for my office but actually for my home

Thats why my outside interface is set to DHCP, if i want a static IP, they would charge me 200 bucks instead of 40 bucks a month. Once it pulls a dynamice address, it rarely changes (once a year maybe twice at the most).

Should i change my outside address to the dynamic address they assigned? Will that work? Is there a way to use the command you showed me to make it work with a dynamic outside address? any more help would be greatly appreciated.

 

[snootalope]

I wish I could tell ya.. I've never done it with a dynamic address so I can't be sure..

but I would say try this:

static (inside,outside) tcp outside domain 192.168.1.4 domain netmask 255.255.255.255

or:

static (inside,outside) tcp interface domain 192.168.1.4 domain netmask 255.255.255.255

but ya know what.. i could be wrong, but what the hell it's your home network.. just use

no static (inside,outside) tcp interface domain 192.168.1.4 domain netmask 255.255.255.255

to remove it..




"tis better to remain silent and be thought of as a fool..
then open your mouth and remove all doubt" Mark Twain

"I should of been a doctor.." Me

 

[N0ktar]

Do you mean forward outside DNS requests to your internal DNS server? Why would you want to do that?
For internal DNS server to serve its internal clients no additional firewall configuuration is required, except for allowing traffic on port 53.
Could you clarify what you are trying to achieve?

 

[wlanman]

Noktar,

On my previous setup, i had a 2514 connected to my cable modem. e0 was connected to my cable modem and used DHCP and all my clients were connected on e1 that went to a 1924 switch. My clients stations consisted of 1 DNS server and 1 web server (two different machines). I updated the registrar for my domain name to point to my DNS server (using the Dynamic IP assigned from my ISP). My 2514 was set up to forward any DNS requests (coming in on e0) to my DNS server that was connected to my swich. The router also forwarded all port 80 requests to my webserver that also is located on my switch. My webserver and DNS used an internal address scheme (192.x.x.x) and I used IP NAT on the router interfaces to do the translations.

I now want to do the same thing with my pix 501, but i cant figure out how to do it. I thought it would be easy using the PDM, but it just seems to complicate things. Thanks in advance to all for helping me solve this problem.

 

[snootalope]

So did you try the:

static (inside,outside) tcp ? domain 192.168.1.4 domain netmask 255.255.255.255

? = being the NAME of the external interface

"tis better to remain silent and be thought of as a fool..
then open your mouth and remove all doubt" Mark Twain

"I should of been a doctor.." Me

 

[wlanman]

IT WORKS !

I used the follwing lines:


access-list inbound permit udp any any eq domain
access-group inbound in interface outside
static (inside,outside) udp interface domain 192.168.1.4 domain netmask 255.255.255.255

Thanks to all who help me solve this problem!!!