Enhancing DNS Server Security: Firewalls and Subnet Isolation

There are several things that you can do to prevent problems. I would recommend putting the DNS servers behind your current firewall and give them a public IP address. When allowing port 53 through the firewall, be sure to allow both TCP and UDP through. I learned this one the hard way the first time I put DNS servers behind a firewall. There were intermittent problems in DNS resolution until both TCP and UDP were allowed through the firewall for port 53. If you put the DNS servers behind your current firewall, I would suggest putting the servers in a different subnet from your server farm or anything else on your network. I would also suggest putting an access control list statement in the switch for the subnet that the DNS servers will be on that doesnt allow traffic from the DNS servers to ingress onto your network and only talk over your Internet connection. Another option is to put the servers on a DMZ connection. Some firewalls allow this with the installation of an additional network card if the firewall you have doesnt have an additional port already available.

Another option is to place the DNS servers behind a seperate firewall that isn't connected to your network. In this way, if the firewall and or one of the DNS servers is compromised, your network won't be in any danger since there isn't a direct connection. If you are open to setting up a 3rd DNS server (assuming that you only have 2 at this point), you can implement yet another protection option. In this type of configuration, both of the forward facing DNS servers are secondary DNS systems. Since the DNS information on this server can't be directly changed, the unauthorized change would only last until the next time the secondary server receives an update from the new master that you have setup. For this to succeed, the master DNS server would not have a public IP address and would be configured to only talk to the secondary DNS servers.

The link for this article located at Network World is no longer available.