<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt; "><span>Finally i forgot this line in my firewall rules:</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal; "><span><br></span></div><div style="background-color: transparent; "><span> iptables -A INPUT -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT<br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal; "><span><br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style:
normal; ">Thanks for all, </div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal; "><span><br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal; "><span><br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal; "><span><br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; background-color: transparent; font-style: normal; "><span><br></span></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt; "><br></div> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; ">
<div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div dir="ltr"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">De:</span></b> Ondřej Surý <ondrej@sury.org><br> <b><span style="font-weight: bold;">Para:</span></b> Ricardo Fraile <rfrail3@yahoo.es> <br><b><span style="font-weight: bold;">CC:</span></b> "unbound-users@unbound.net" <unbound-users@unbound.net> <br> <b><span style="font-weight: bold;">Enviado:</span></b> Jueves 29 de noviembre de 2012 17:35<br> <b><span style="font-weight: bold;">Asunto:</span></b> Re: [Unbound-users] Unbound and firewall<br> </font> </div> <br><meta http-equiv="x-dns-prefetch-control" content="off"><div id="yiv142186756"><div><div>You really don't want to do that. Lookup up and read about Kaminsky DNS bug.<br><br>Ondřej Surý</div><div><br>On 29. 11. 2012, at 16:59, Ricardo Fraile <<a rel="nofollow"
ymailto="mailto:rfrail3@yahoo.es" target="_blank" href="mailto:rfrail3@yahoo.es">rfrail3@yahoo.es</a>> wrote:<br><br></div><blockquote type="cite"><div><div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "><div><span><div>I think that the unbound open an arbitrary udp port, how can I fix for use always the same port?</div><div><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; background-color: transparent; font-style: normal; font-family: 'times new roman', 'new york', times, serif; "><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; background-color: transparent; font-style: normal; font-family: 'times new roman', 'new york', times, serif; "><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; background-color: transparent; font-style: normal; font-family: 'times new roman', 'new york', times, serif; ">Active Internet connections
(servers and established)</div><div>Proto Recv-Q Send-Q Local Address Foreign Address State
PID/Program name</div><div>udp 0 0 0.0.0.0:53 0.0.0.0:* 1152/unbound </div><div>udp 0 0 0.0.0.0:17790 0.0.0.0:* 1152/unbound </div><div><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; background-color: transparent; font-style: normal; font-family: 'times new roman', 'new york', times, serif; "><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; background-color: transparent; font-style: normal; font-family: 'times new roman', 'new york', times, serif; "><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; background-color: transparent; font-style: normal;
font-family: 'times new roman', 'new york', times, serif; "><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; background-color: transparent; font-style: normal; font-family: 'times new roman', 'new york', times, serif; "><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; background-color: transparent; font-style: normal; font-family: 'times new roman', 'new york', times, serif; ">thanks,</div></span></div><div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "><br></div> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div dir="ltr"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">De:</span></b> Ricardo Fraile <<a rel="nofollow" ymailto="mailto:rfrail3@yahoo.es" target="_blank" href="mailto:rfrail3@yahoo.es">rfrail3@yahoo.es</a>><br>
<b><span style="font-weight:bold;">Para:</span></b> "<a rel="nofollow" ymailto="mailto:unbound-users@unbound.net" target="_blank" href="mailto:unbound-users@unbound.net">unbound-users@unbound.net</a>"
<<a rel="nofollow" ymailto="mailto:unbound-users@unbound.net" target="_blank" href="mailto:unbound-users@unbound.net">unbound-users@unbound.net</a>> <br> <b><span style="font-weight:bold;">Enviado:</span></b> Jueves 29 de noviembre de 2012 16:43<br> <b><span style="font-weight:bold;">Asunto:</span></b> Unbound and firewall<br> </font> </div> <br><div id="yiv142186756"><div><div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "><div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; ">Hello, <br></div><div style="font-family: 'times new roman', 'new york', times, serif; "><div style="font-family: 'times new roman', 'new york', times, serif; "><div id="yiv142186756"><div><div style="background-color: rgb(255, 255, 255); font-family: 'times new roman', 'new york', times, serif; "><div style="color: rgb(0, 0, 0); font-size:
12pt; font-family: 'times new roman', 'new york', times, serif; "><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; background-color: transparent; font-style: normal; font-family: 'times new roman', 'new york', times, serif; "> I try to put iptables in the same server that unbound but <span class="yiv142186756Apple-tab-span" style="white-space:pre;"> </span>I can't do a
local resolv:</div><div style="color: rgb(0, 0, 0); font-size: 16px; background-color: transparent; font-style: normal; font-family: 'times new roman', 'new york', times, serif; "><br></div><div style="background-color: transparent; font-family: 'times new roman', 'new york', times, serif; "><div style="background-color:transparent;" class="yiv142186756yui_3_7_2_14_1354203676587_66">dig <a rel="nofollow" target="_blank" href="http://terra.es/">terra.es</a> @127.0.0.1</div><div style="background-color:transparent;" class="yiv142186756yui_3_7_2_14_1354203676587_66"><br></div><div style="background-color:transparent;" class="yiv142186756yui_3_7_2_14_1354203676587_66">; <<>> DiG 9.7.3 <<>> <a rel="nofollow" target="_blank" href="http://terra.es/">terra.es</a> @127.0.0.1</div><div style="background-color:transparent;" class="yiv142186756yui_3_7_2_14_1354203676587_66">;; global options: +cmd</div><div
style="background-color:transparent;" class="yiv142186756yui_3_7_2_14_1354203676587_66">;; connection timed out; no servers could be reached</div><div style="color:rgb(0, 0, 0);font-family:'times new
roman', 'new york', times, serif;font-size:16px;font-style:normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-style: normal; font-family: 'times new roman', 'new york', times, serif; "><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-style: normal; font-family: 'times new roman', 'new york', times, serif; "><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-style: normal; font-family: 'times new roman', 'new york', times, serif; ">whit this iptables rules:</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-style: normal; font-family: 'times new roman', 'new york', times, serif; "><br></div><div><div>:INPUT ACCEPT [0:0]</div><div>:FORWARD ACCEPT [0:0]</div><div>:OUTPUT ACCEPT [2271:2106405]</div><div>-A INPUT -s 30.0.0.0/8 -p tcp -j ACCEPT </div><div>-A INPUT -s 30.0.0.0/8 -p udp -j ACCEPT </div><div>-A INPUT -s 30.0.0.0/8 -p icmp -j ACCEPT </div><div>-A INPUT -s
127.0.0.1/32 -p udp -j ACCEPT </div><div>-A INPUT -s 127.0.0.1/32 -p tcp -j ACCEPT </div><div>-A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT </div><div>-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT <br></div><div>-A INPUT -p udp -m udp --dport 53 -j ACCEPT </div><div>-A INPUT -j DROP </div><div>COMMIT</div><div><br></div><div><br></div><div><br></div><div>If I clean the firewall, all works, but why? Which ports use unbound for the queries?</div><div><br></div><div><br></div><div>Thanks,</div></div></div><div style="color: rgb(0, 0, 0); font-size: 16px; background-color: transparent; font-style: normal; font-family: 'times new roman', 'new york', times, serif; "><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; background-color: transparent; font-style: normal; font-family: 'times new roman', 'new york', times, serif; "><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; background-color:
transparent; font-style: normal; font-family: 'times new roman', 'new york', times, serif; "><br></div></div></div></div><br><br> </div> </div> </div></div></div><br><br> </div> </div> </div></div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Unbound-users mailing list</span><br><span><a rel="nofollow" ymailto="mailto:Unbound-users@unbound.net" target="_blank" href="mailto:Unbound-users@unbound.net">Unbound-users@unbound.net</a></span><br><span><a rel="nofollow" target="_blank" href="http://unbound.nlnetlabs.nl/mailman/listinfo/unbound-users">http://unbound.nlnetlabs.nl/mailman/listinfo/unbound-users</a></span></div></blockquote></div></div><meta http-equiv="x-dns-prefetch-control" content="on"><br><br> </div> </div> </div></body></html>