> In message <alpine.lsu.2.00.1206121230490.2...@hermes-2.csi.cam.ac.uk>, Tony
> Fi
> nch writes:
> > Mark Andrews <ma...@isc.org> wrote:
> > >
> > > Perhaps because it is a legitimate, though unwise, client source port
> > > that is in lots of old configurations.
> > >
> > > listen-on { <internal address>; };
> > > query-source * port 53;
> >
> > I did this back in the 1990s because it worked around occasional interop
> > problems, I think caused by over-enthusiastic firewall configurations that
> > thought all DNS (queries and responses) should be on port 53. Several
> > years ago I found that things had changed and the popular over-
> > enthusiastic firewall configuration requires DNS query source ports to be
> > greater than 1023.
>
> Both firewall configuration are broken. You don't look at source
> ports if you are offering a service.
Sure you can. And sometimes do. That's what the whole privileged port
thing is about, right? Sometimes it is desirable to constrain the
possibilities for various reasons.
... JG
--
Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net
"We call it the 'one bite at the apple' rule. Give me one chance [and] then I
won't contact you again." - Direct Marketing Ass'n position on e-mail spam(CNN)
With 24 million small businesses in the US alone, that's way too many apples.
_______________________________________________
dns-operations mailing list
dns-operations@lists.dns-oarc.net
https://lists.dns-oarc.net/mailman/listinfo/dns-operations
dns-jobs mailing list
https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
