Raptor 6.5NT: DNS through the Firewall (NO PROXY)

[finlan]

hi,

i am trying to achive the following:

direct DNS access through the raptor without using the dns-proxy.

i have created a rule which allows me to access DNS (all DNS paket types) from the DMZ to Universe. There is a DNS running on the raptor, which i don't want to use. i want to get DNS queries to a DNS server elsewhere.

i have activated GSPD for tcp and udp.

and guess what: it's not working. i keep getting ICMP messages that port 53 udp is not reachable from the raptor.

Mar 26 11:09:50.457 fire1 kernel: 232 Sending ICMP port unreachable. Original packet (192.168.33.19->192.5.5.241: Protocol=UDP Port 32768->53) received on interface 192.168.33.18

where 33.19 is the requesting server, 192.5.5.241 is the DNS server an 33.18 is the DMZ interface.

i have set up various other services the same way, everything is fine. but NONE of the other services are running a proxy for that service in parallel.

i am really screwed up.

additionally there is another error which the system reports after activating the udp GSPD-proxy, which we didn't need before:

the error message is in german so i try to translate it:
"an attached device is not working" this error refers to the GSPD-proxy.

any clues ? i am running out of options.

fin

 

[KSM]

We use Raptor 6.5 NT in my department. In Raptor, if you want to pass through dns packets, you have to disable the dns service in Raptor.
Only one choice at a time.

 

[finlan]

i guessed so ...
thanx for the answer !
fin

 

[MonaMi]

Hi,
I am using Raptor 4 on HP-UX 10.20 and recently while going through some reconfiguration, I started to get these messages - 232 Sending ICMP host(prohibited) unreachable. Original packet (UDP: 172.20.3.38/138 -> 172.20.5.255/138) from interface lan2 scrolling on the screen every few minutes. I don't have a clue what going on.
Appreciate if you can point out what went wrong or how to turn off the messages.
Thanks

 

[johnny99]

You can have both the DNS proxy running and passing DNS traffic through.

My firewall tech. said the same and also the external consultant.

I needed us to run our own public DNS servers and I also needed some internal DNS servers.

After 2-3 months when I keeps telling them that there had to be a solution they found it.

If you need the same as I needed I can ask my firewall tech. to tell me how they did it. It was very simple I remember.

/johnny