Blocking port 53 incoming only.
I want to close port 53 to incoming requests after being advised by my ISP that I have a potential Open DNS Resolver. Obviously, I need clients on my network to make DNS queries, but I have no use for devices outside my network querying device(s) on my network for DNS entries. So I want to block the port from accepting any incoming traffic. How is this done?
"We're writing to let you know that a device connected to your home network has been identified as having a potential Open DNS Resolver (ODNSR) vulnerability.
An open DNS resolver lets any computer system on the internet use it, not just the intended local or authorised users on networks that you control and/or trust.
It is therefore important that you follow the advice in this letter.
What has happened?
We suspect the device may have been misconfigured by you, someone in your household or without your knowledge. If the settings are left unchanged they can be exploited to unwittingly participate in malicious activities, for example a Distributed Denial of Service (DDoS) attack."
@woozle It's concerning isn't it.
"With DMZ and UPnP not in use incoming requests on port 53 can't end up on one of your client devices". None of my clients are acting as an ODNSR, none of them are configured to serve DNS queries: it's the router. My tp-link AX3000 (AX53) Wi-Fi router is serving DNS requests from outside my LAN. The simplest way to prevent this is to block port 53, but there is no simple way to do this on the offending device. Hence my profound frustration with tp-link...so I don't have my VirginMedia services throttled or curtailed I have an (overkill) solution:
Thanks tp-link...
With UPnP activated the local client devices (or more precisely the software running on them) can basically add port forwarding rules on their own to the router.
Port forwarding rules that have been added by clients via UPnP would show up in the UPnP Client List, like illustrated in the screenshot below.
Now, if the user needed the rules "test2" and "test3" to make some legit features work inside the LAN, but wanted to get rid of rule "test1" that allows access to an internal Open DNS Resolver from the Internet, then he should deactivate UPnP and instead just add the rules "test2" and "test3" manually via the "Port Forwarding" menu.
Question is, do you see a entry for port 53 in the UPnP Client List of your AX3000?
@woozle It's concerning isn't it.
"With DMZ and UPnP not in use incoming requests on port 53 can't end up on one of your client devices". None of my clients are acting as an ODNSR, none of them are configured to serve DNS queries: it's the router. My tp-link AX3000 (AX53) Wi-Fi router is serving DNS requests from outside my LAN. The simplest way to prevent this is to block port 53, but there is no simple way to do this on the offending device. Hence my profound frustration with tp-link...so I don't have my VirginMedia services throttled or curtailed I have an (overkill) solution:
Thanks tp-link...
