Solved

odd entries in domaindnszones and forest dns zones causing firewall to drop packets for spoofed IP.

Posted on 2008-10-01
4
798 Views
Last Modified: 2013-11-16
I am not the one that initially configured this server and am not an expert with DNS. I noticed that our Checkpoint VPN-1 Edge firewall is showing packets blocked from the IP address 192.168.116.1 on poert 137 for spoofed IP.

I looked under Forward Lookup Zones > ourdomain.com > domaindnszones, and found in addition to an A record for the IP address of this server, there are two other records, one for 192.168.116.1, and one for 192.168.153.1. These addresses appear to be the server itself, as when i type in \\192.168.116.1 in explorer i get the shares. When I ping this ip address from any other workstation it times out.

As far as I know, none of our devices are in the 192.168.116.x range, we use a 255.255.255.0 subnet mask. I figure I should delete these entries. Can anyone explain to me what these entries are intended to be for and why they might be there?


Note: these entries are alos in Forward Lookup Zones > ourdomain.com > forestdnszones

Also, these spoofed IP entires always seem to be after a request on port 137 from a VPN client (our vpn clients are on 192.158.254.x, 192.168.1.200 is our server)
2008-09-30 19:15:28	Local7.Info	192.168.1.99	2008 Sep 30 18:16:12 00:08:da:72:ef:60 <50000> Decrypted Inbound packet (Custom rule) Src:192.168.254.24 SPort:137 Dst:192.168.1.200 DPort:137 IPP:17 Rule:5 Interface:WAN (Internet)
2008-09-30 19:15:34	Local7.Info	192.168.1.99	2008 Sep 30 18:16:18 00:08:da:72:ef:60 <50000> Dropped Outbound packet (Spoofed IP) Src:192.168.116.1 SPort:137 Dst:192.168.254.24 DPort:137 IPP:17 Rule:-4 Interface:LAN

Open in new window

0
Comment
Question by:bradl3y
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 71

Accepted Solution

by:
Chris Dent earned 500 total points
ID: 22615497

> poert 137

NetBIOS name resolution port... so you can pretty much discard everything you see in DNS as being relevant.

> When I ping this ip address from any other workstation it times out.

If it's an additional interface on the server the client may not have a route.

> figure I should delete these entries

You might find they re-appear fairly quickly though. It depends on their origin but it's likely that they're dynamically added. You can verify that by clicking View, Advanced, then opening the properties for the record. See if it can be scavenged when it becomes stale.

Chris
0
 
LVL 6

Author Comment

by:bradl3y
ID: 22615648
Ah ha,
An IP config shows those IP addreses assigned to 2 VMWare virtual interfaces. The server only has 1 physical interface, so the server is sending packets with the IP of the VMWare interfaces in the header, how do I force it to use the real interface? Why would it be replying with the IP address of an interface that the request was not received on?
0
 
LVL 71

Assisted Solution

by:Chris Dent
Chris Dent earned 500 total points
ID: 22615737

NetBIOS... such an evil thing.

You might unbind Client for Microsoft Networks and disable NetBIOS for those two interfaces (advanced tcp/ip properties). Otherwise it will try and announce on each network interface.

That still leaves the entries registering in DNS. Is the server actually running virtual servers? Or just the service?

Chris
0
 
LVL 6

Author Comment

by:bradl3y
ID: 22616417
It is currently just running the service, but it will be used eventually. For now i unchecked those settings and disabled the adapters, i'd imagine this will fix the spoofed IP problems. In the future when I need to use vmware i will further troubleshoot to see if just disabling netbios did the trick. Thanks for the help.
0

Featured Post

2017 Webroot Threat Report

MSPs: Get the facts you need to protect your clients.
The 2017 Webroot Threat Report provides a uniquely insightful global view into the analysis and discoveries made by the Webroot® Threat Intelligence Platform to provide insights on key trends and risks as seen by our users.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Master-Master-Slave BIND setup 2 77
Why NS record is needed in Zone file? 11 56
BgInfo help 5 109
Exchange 2016 - not receiving mail 17 101
There have been a lot of times when we have seen the need to enter a large number of DNS entries in a forward lookup zone. The standard procedure would be to launch the DNS Manager console, create the Zone and start adding new hosts using the New…
The DROP (Spamhaus Don't Route Or Peer List) is a small list of IP address ranges that have been stolen or hijacked from their rightful owners. The DROP list is not a DNS based list.  It is designed to be downloaded as a file, with primary intention…
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question