PIX 506, Windows 2000, and DNS 1

[dougnc]

I have a pix 506 firewall, and I'm trying to run a web site and dns on the server inside the firewall. Internet Solutions, tho, can't seem to see my dns.

Is there something I need to do to enable DNS? I did the
access-list acl_out eq 53 on both the inner ip and the outer.

Any help would be greatly appreciated.

 

[webnetwiz]

post the config (modified, of course), and I'll see what I can do.

 

[hatchet66]

are you using a cisco router, or a linksys with NAT?? Im trying to do the same, but with a linksys on broadband connection... the double nat thing i think is screwing me up... Im trying to forward all ports to the outside interface of the pix (from the linksys), and then trying to pick and choose my access-lists, but no luck..if anyone is running the same setup, please let me know...

Dave

 

[xlee]

You will need a static mapping to the internal server. Then create the access-list to allow port 53 udp/tcp and apply it to the outside interface.

 

[dougnc]

Now it's getting strange. If I go to another location, and do a

http://website.com,

without the www, the browser says finding 10.x.x.x, my internal web site address. I didn't really want my internal addresses getting out.

http://www.website.com,

still gets me nothing.

But now I have to figure out why the pix firewall is letting internal addresses out.

 

[Bluecrack]

Running a DNS server internally can be done, but it is usually better to split the DNS inside and outside. Run a DNS server inside for your internal clients and then run an external DNS server outside the firewall for public access. This helps hide you internal network design and there is one less hole in the firewall. The downside is that you then have two DNS servers to administer and you must lock down the external server (disable unused daemons/services, access-lists on or external router, etc).

However, you should be able to configure the DNS server to be queried internally with the following commands.

static (inside,outside) y.y.y.y x.x.x.x netmask 255.255.255.255
access-list acl_out permit udp any host y.y.y.y eq 53
access-group acl_out in interface outside

In this case y.y.y.y is the external address of the DNS server and x.x.x.x is the internal address of the server.

Once that is working and you can successfully query the DNS server, you then need to make sure DNS is setup with the correct address for

http://www.website.com

and

http://website.com.

Bluecrack

 

[dougnc]

Thanks Bluecrack! I had just wiped up my pix configuraton and started redoing it, when I got your message.

Still, when I was finished I still got my internal address from outside browsers looking for

http://www.website.com.

I thought pix automatically translated this stuff.

I then tried
alias (outside) 99.99.99.99 10.10.10.10 255.255.255.255

That didn't work, so I tried:
alias (inside) 10.10.10.10 99.99.99.99 255.255.255.255

That did it, except I had to access-list tcp eq www.

 

[Bluecrack]

Good to hear it's working.

 

[Guest_imported]

Hi
I can config the pix firewall 506 without nat?