Can't access BIND DNS server behind iptables - Server Fault
dns iptables bind share|improve this question asked Jul 13 '11 at 23:28
3 Actually, you need both TCP and UDP. UDP for most queries and TCP for any larger amount of data such as a zone transfer.
1 @dmourati, you only need TCP if you are doing a zone transfers or you have a ridiculously large DNS RR or a GIANT TXT record and a large one at that. for 90% of the use cases all you need is udp 53 and opening ports you don't need is not a great idea.
2 It's not easy to predict when you'll need to do DNS over TCP, and there are a lot more instances where it's becoming required (stuffing DNSSEC into a UDP packet can get exciting). Advising people who don't know what they're doing to restrict tcp/53 is a recipe for incredibly difficult-to-diagnose DNS resolution problems.
1 @Zypher Both UDP and TCP are needed - dmourati is right. ObDisclaimer - I wrote that RFC.
Not the answer you're looking for?	Browse other questions tagged dns iptables bind or ask your own question.	tagged
bind × 1011
Is it necessary to stop iptables when you behind router to access your httpd (centos on wmware)?
Can't access BIND DNS server behind iptables - Server Fault
dns iptables bind share|improve this question asked Jul 13 '11 at 23:28
3 Actually, you need both TCP and UDP. UDP for most queries and TCP for any larger amount of data such as a zone transfer.
1 @dmourati, you only need TCP if you are doing a zone transfers or you have a ridiculously large DNS RR or a GIANT TXT record and a large one at that. for 90% of the use cases all you need is udp 53 and opening ports you don't need is not a great idea.
2 It's not easy to predict when you'll need to do DNS over TCP, an
d there are a lot more instances where it's becoming required (stuffing DNSSEC into a UDP packet can get exciting). Advising people who don't know what they're doing to restrict tcp/53 is a recipe for incredibly difficult-to-diagnose DNS resolution problems.
1 @Zypher Both UDP and TCP are needed - dmourati is right. ObDisclaimer - I wrote that RFC.
Not the answer you're looking for?	Browse other questions tagged dns iptables bind or ask your own question.	tagged
bind × 1011
Is it necessary to stop iptables when you behind router to access your httpd (centos on wmware)?