• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 807
  • Last Modified:

odd entries in domaindnszones and forest dns zones causing firewall to drop packets for spoofed IP.

I am not the one that initially configured this server and am not an expert with DNS. I noticed that our Checkpoint VPN-1 Edge firewall is showing packets blocked from the IP address 192.168.116.1 on poert 137 for spoofed IP.

I looked under Forward Lookup Zones > ourdomain.com > domaindnszones, and found in addition to an A record for the IP address of this server, there are two other records, one for 192.168.116.1, and one for 192.168.153.1. These addresses appear to be the server itself, as when i type in \\192.168.116.1 in explorer i get the shares. When I ping this ip address from any other workstation it times out.

As far as I know, none of our devices are in the 192.168.116.x range, we use a 255.255.255.0 subnet mask. I figure I should delete these entries. Can anyone explain to me what these entries are intended to be for and why they might be there?


Note: these entries are alos in Forward Lookup Zones > ourdomain.com > forestdnszones

Also, these spoofed IP entires always seem to be after a request on port 137 from a VPN client (our vpn clients are on 192.158.254.x, 192.168.1.200 is our server)
2008-09-30 19:15:28	Local7.Info	192.168.1.99	2008 Sep 30 18:16:12 00:08:da:72:ef:60 <50000> Decrypted Inbound packet (Custom rule) Src:192.168.254.24 SPort:137 Dst:192.168.1.200 DPort:137 IPP:17 Rule:5 Interface:WAN (Internet)
2008-09-30 19:15:34	Local7.Info	192.168.1.99	2008 Sep 30 18:16:18 00:08:da:72:ef:60 <50000> Dropped Outbound packet (Spoofed IP) Src:192.168.116.1 SPort:137 Dst:192.168.254.24 DPort:137 IPP:17 Rule:-4 Interface:LAN

Open in new window

0
bradl3y
Asked:
bradl3y
  • 2
  • 2
2 Solutions
 
Chris DentPowerShell DeveloperCommented:

> poert 137

NetBIOS name resolution port... so you can pretty much discard everything you see in DNS as being relevant.

> When I ping this ip address from any other workstation it times out.

If it's an additional interface on the server the client may not have a route.

> figure I should delete these entries

You might find they re-appear fairly quickly though. It depends on their origin but it's likely that they're dynamically added. You can verify that by clicking View, Advanced, then opening the properties for the record. See if it can be scavenged when it becomes stale.

Chris
0
 
bradl3yAuthor Commented:
Ah ha,
An IP config shows those IP addreses assigned to 2 VMWare virtual interfaces. The server only has 1 physical interface, so the server is sending packets with the IP of the VMWare interfaces in the header, how do I force it to use the real interface? Why would it be replying with the IP address of an interface that the request was not received on?
0
 
Chris DentPowerShell DeveloperCommented:

NetBIOS... such an evil thing.

You might unbind Client for Microsoft Networks and disable NetBIOS for those two interfaces (advanced tcp/ip properties). Otherwise it will try and announce on each network interface.

That still leaves the entries registering in DNS. Is the server actually running virtual servers? Or just the service?

Chris
0
 
bradl3yAuthor Commented:
It is currently just running the service, but it will be used eventually. For now i unchecked those settings and disabled the adapters, i'd imagine this will fix the spoofed IP problems. In the future when I need to use vmware i will further troubleshoot to see if just disabling netbios did the trick. Thanks for the help.
0

Featured Post

The eGuide to Automating Firewall Change Control

Today‚Äôs IT environment is constantly changing, which affects security policies and firewall rules. Discover tips to help you embrace this change through process improvement & identify areas where automation & actionable intelligence can enhance both security and business agility.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now