Solved

odd entries in domaindnszones and forest dns zones causing firewall to drop packets for spoofed IP.

Posted on 2008-10-01
4
797 Views
Last Modified: 2013-11-16
I am not the one that initially configured this server and am not an expert with DNS. I noticed that our Checkpoint VPN-1 Edge firewall is showing packets blocked from the IP address 192.168.116.1 on poert 137 for spoofed IP.

I looked under Forward Lookup Zones > ourdomain.com > domaindnszones, and found in addition to an A record for the IP address of this server, there are two other records, one for 192.168.116.1, and one for 192.168.153.1. These addresses appear to be the server itself, as when i type in \\192.168.116.1 in explorer i get the shares. When I ping this ip address from any other workstation it times out.

As far as I know, none of our devices are in the 192.168.116.x range, we use a 255.255.255.0 subnet mask. I figure I should delete these entries. Can anyone explain to me what these entries are intended to be for and why they might be there?


Note: these entries are alos in Forward Lookup Zones > ourdomain.com > forestdnszones

Also, these spoofed IP entires always seem to be after a request on port 137 from a VPN client (our vpn clients are on 192.158.254.x, 192.168.1.200 is our server)
2008-09-30 19:15:28	Local7.Info	192.168.1.99	2008 Sep 30 18:16:12 00:08:da:72:ef:60 <50000> Decrypted Inbound packet (Custom rule) Src:192.168.254.24 SPort:137 Dst:192.168.1.200 DPort:137 IPP:17 Rule:5 Interface:WAN (Internet)
2008-09-30 19:15:34	Local7.Info	192.168.1.99	2008 Sep 30 18:16:18 00:08:da:72:ef:60 <50000> Dropped Outbound packet (Spoofed IP) Src:192.168.116.1 SPort:137 Dst:192.168.254.24 DPort:137 IPP:17 Rule:-4 Interface:LAN

Open in new window

0
Comment
Question by:bradl3y
  • 2
  • 2
4 Comments
 
LVL 70

Accepted Solution

by:
Chris Dent earned 500 total points
ID: 22615497

> poert 137

NetBIOS name resolution port... so you can pretty much discard everything you see in DNS as being relevant.

> When I ping this ip address from any other workstation it times out.

If it's an additional interface on the server the client may not have a route.

> figure I should delete these entries

You might find they re-appear fairly quickly though. It depends on their origin but it's likely that they're dynamically added. You can verify that by clicking View, Advanced, then opening the properties for the record. See if it can be scavenged when it becomes stale.

Chris
0
 
LVL 6

Author Comment

by:bradl3y
ID: 22615648
Ah ha,
An IP config shows those IP addreses assigned to 2 VMWare virtual interfaces. The server only has 1 physical interface, so the server is sending packets with the IP of the VMWare interfaces in the header, how do I force it to use the real interface? Why would it be replying with the IP address of an interface that the request was not received on?
0
 
LVL 70

Assisted Solution

by:Chris Dent
Chris Dent earned 500 total points
ID: 22615737

NetBIOS... such an evil thing.

You might unbind Client for Microsoft Networks and disable NetBIOS for those two interfaces (advanced tcp/ip properties). Otherwise it will try and announce on each network interface.

That still leaves the entries registering in DNS. Is the server actually running virtual servers? Or just the service?

Chris
0
 
LVL 6

Author Comment

by:bradl3y
ID: 22616417
It is currently just running the service, but it will be used eventually. For now i unchecked those settings and disabled the adapters, i'd imagine this will fix the spoofed IP problems. In the future when I need to use vmware i will further troubleshoot to see if just disabling netbios did the trick. Thanks for the help.
0

Featured Post

Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I've written instructions for one router type, but this principle may be useful for others of the same brand and even other brands of router. Problem: I had an issue especially with mobile devices that refused to use DNS information supplied via…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…
In an interesting question (https://www.experts-exchange.com/questions/29008360/) here at Experts Exchange, a member asked how to split a single image into multiple images. The primary usage for this is to place many photographs on a flatbed scanner…

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question