Email from Virgin with open dns resolver - (vulnerable service)

[caffrey]

I've just had an email from Virgin stating "Our investigations have highlighted the below vulnerabilities / malware on your network. Please view the attachment for additional information."

 

"open dns resolver - (vulnerable service)"

 

I've port scanned our network externally and yes port 53 is open, however I have no port forwards for that port on Smoothwall to any internal devices

 

Has something changed with the latest Smoothwall ? Or is it something else ? Only thing we've changed recently is hosting the school website but wordfence is reporting that as okay.

[SchoolsBroadband]

it means that someone can use the DNS from that port and IP. Is your smoothwall setup to do DNS for your internal network? Have you allowed it to do so on your external WAN too?

 

Dave

[caffrey]

Internal DNS is just standard Microsoft DNS and Smoothwall has them as conditional DNS forwarders

[Securly_Chris]

Hi,

 

If you're using Smoothwall as your firewall check your "Smoothwall access" rules and "Firewall Rules" for any that might be permitting external access to DNS services (TCP/UDP port 53).

 

Regards,

Chris

 

P.s Amended with *external* access - you will likely see rules permitting access on your internal interfaces but you'll need those if you use the DNS forwarders internally.

Edited June 5, 2017 by Securly_Chris
Clarification

[caffrey]

All the rules are just migrated, nothing there that I can see is allow external to internal

 

[Securly_Chris]

They look like they're internal to internal or internal to external so doubt it's any of those. Could you send me a screenshot of the "Smoothwall Access" rules?

[caffrey]

Hrrm lots of 53 here, I didn't check those rules, they are all migrated

 

[Securly_Chris]

Yes, you'll want to go through and review all those rules to see if they're still needed.

 

At a glance, 2,3 and 6 permit various Smoothwall services to be accessed over the Internet so should be removed or locked down.

[caffrey]

Must've been when the new firewall interface was introduced, by the looks of things it's enabled all the rules where I was sure some of those were disabled previously. I'll just disable them and see what happens cheers

 

*edit*

 

Disabling them has fixed it thanks again.

Edited June 5, 2017 by caffrey