Subject: RE: DNS and NTP

From: "Lidgate, Chris A" <[email-masked]>
Date: Wed, 8 Mar 2000 09:20:13 -0600

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

> ----------
> From: 	Scott McEachern[SMTP:[email-masked]]
> Sent: 	08 March 2000 14:23
> To: 	Lidgate, Chris A
> Subject: 	Re: DNS and NTP
> 
> "Lidgate, Chris A" wrote:
> 
> > The standard way of doing this is to run a named process
> > on your fwtk firewall just as if it was a secondary dns
> > server for your *external* domain. You then set up your
> > *internal* dns servers to use the forward keyword, such
> > that they will query the fwtk dns server (usually) *before*
> > they try and resolve the hostname queries themselves.
> 
> This is the standard?  (Like I said, I'm new ;-)  I work on the policy of
> using as few services/ports as possible.
> 
As to wether it's standard or not - I got my info
from the mailing list ~ 2 years ago as I remember.
I actually thought that there might be a topic about 
this in the ftwk faq, but there doesn't seem to be - 
odd. There is the following

	http://www.fwtk.org/fwtk/docs/documentation.html#3.1

But notice that this goes some way BEYOND what you 
described (ie if you follow this note, your *firewall*
can resolve your *internal* names, as well as allowing 
your internal machines to resolve external names).

I certainly agree with you in principle tho' that it's
best to close down the firewall as much as possible.

> Also, the vast majority of my lookups will be internal, so I figure I'll
> look internally first.
> 
This was very much my reasoning. It actually took
me sometime to get it working, but now that it is,
it is the business! If you need any pointers get 
back to me, this is exactly how I set up our stuff. 

I found that the dns newsgroup (comp.protocols.bind ?? - 
something like that anyway) was very good, combined with
deja news.

> > There are some clever games you can play with "forward only"
> > keyword on the internal dns server, such that instead of the
> > default behavoiur, the queries are only forwarded to the
> > fwtk dns server *iff* the domain is not part of your internal
> > dns, but these are implememtation details.
> 
> I will fiddle with that today (ok, until I succeed ;-)
> 
> > Of course this goes against your assertion that "I really
> > don't want to have the firewall acting as a name server".
> >
> > Why ? Is this just for security ? or do you you have some
> > other reason ?
> 
> Security is the only reason.  I use bind v8.2.2 p5, the latest version.
> 
That's what we use.

> > >     Another question, similar to the above, is the same but for
> network
> > > time (NTP.)
> > >
> > The answer here is much the same, run the xntpd deamon on
> > your firewall box, and allow internal machines to access it.
> >
> > xntpd allows some fairly sophisticated settings for access
> > controls, set them up so that your xntpd is only allowed to
> > access the higher stratum servers for it's own time
> > adjustments, but is allowed to serve time to your local net.
> 
> I'll go about setting that up too, today.
> 
> Thanks very much for your help, it is appreciated!
>