Solved

odd entries in domaindnszones and forest dns zones causing firewall to drop packets for spoofed IP.

Posted on 2008-10-01
4
794 Views
Last Modified: 2013-11-16
I am not the one that initially configured this server and am not an expert with DNS. I noticed that our Checkpoint VPN-1 Edge firewall is showing packets blocked from the IP address 192.168.116.1 on poert 137 for spoofed IP.

I looked under Forward Lookup Zones > ourdomain.com > domaindnszones, and found in addition to an A record for the IP address of this server, there are two other records, one for 192.168.116.1, and one for 192.168.153.1. These addresses appear to be the server itself, as when i type in \\192.168.116.1 in explorer i get the shares. When I ping this ip address from any other workstation it times out.

As far as I know, none of our devices are in the 192.168.116.x range, we use a 255.255.255.0 subnet mask. I figure I should delete these entries. Can anyone explain to me what these entries are intended to be for and why they might be there?


Note: these entries are alos in Forward Lookup Zones > ourdomain.com > forestdnszones

Also, these spoofed IP entires always seem to be after a request on port 137 from a VPN client (our vpn clients are on 192.158.254.x, 192.168.1.200 is our server)
2008-09-30 19:15:28	Local7.Info	192.168.1.99	2008 Sep 30 18:16:12 00:08:da:72:ef:60 <50000> Decrypted Inbound packet (Custom rule) Src:192.168.254.24 SPort:137 Dst:192.168.1.200 DPort:137 IPP:17 Rule:5 Interface:WAN (Internet)

2008-09-30 19:15:34	Local7.Info	192.168.1.99	2008 Sep 30 18:16:18 00:08:da:72:ef:60 <50000> Dropped Outbound packet (Spoofed IP) Src:192.168.116.1 SPort:137 Dst:192.168.254.24 DPort:137 IPP:17 Rule:-4 Interface:LAN

Open in new window

0
Comment
Question by:bradl3y
  • 2
  • 2
4 Comments
 
LVL 70

Accepted Solution

by:
Chris Dent earned 500 total points
ID: 22615497

> poert 137

NetBIOS name resolution port... so you can pretty much discard everything you see in DNS as being relevant.

> When I ping this ip address from any other workstation it times out.

If it's an additional interface on the server the client may not have a route.

> figure I should delete these entries

You might find they re-appear fairly quickly though. It depends on their origin but it's likely that they're dynamically added. You can verify that by clicking View, Advanced, then opening the properties for the record. See if it can be scavenged when it becomes stale.

Chris
0
 
LVL 6

Author Comment

by:bradl3y
ID: 22615648
Ah ha,
An IP config shows those IP addreses assigned to 2 VMWare virtual interfaces. The server only has 1 physical interface, so the server is sending packets with the IP of the VMWare interfaces in the header, how do I force it to use the real interface? Why would it be replying with the IP address of an interface that the request was not received on?
0
 
LVL 70

Assisted Solution

by:Chris Dent
Chris Dent earned 500 total points
ID: 22615737

NetBIOS... such an evil thing.

You might unbind Client for Microsoft Networks and disable NetBIOS for those two interfaces (advanced tcp/ip properties). Otherwise it will try and announce on each network interface.

That still leaves the entries registering in DNS. Is the server actually running virtual servers? Or just the service?

Chris
0
 
LVL 6

Author Comment

by:bradl3y
ID: 22616417
It is currently just running the service, but it will be used eventually. For now i unchecked those settings and disabled the adapters, i'd imagine this will fix the spoofed IP problems. In the future when I need to use vmware i will further troubleshoot to see if just disabling netbios did the trick. Thanks for the help.
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

Resolve DNS query failed errors for Exchange
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now