Solved

odd entries in domaindnszones and forest dns zones causing firewall to drop packets for spoofed IP.

Posted on 2008-10-01
4
799 Views
Last Modified: 2013-11-16
I am not the one that initially configured this server and am not an expert with DNS. I noticed that our Checkpoint VPN-1 Edge firewall is showing packets blocked from the IP address 192.168.116.1 on poert 137 for spoofed IP.

I looked under Forward Lookup Zones > ourdomain.com > domaindnszones, and found in addition to an A record for the IP address of this server, there are two other records, one for 192.168.116.1, and one for 192.168.153.1. These addresses appear to be the server itself, as when i type in \\192.168.116.1 in explorer i get the shares. When I ping this ip address from any other workstation it times out.

As far as I know, none of our devices are in the 192.168.116.x range, we use a 255.255.255.0 subnet mask. I figure I should delete these entries. Can anyone explain to me what these entries are intended to be for and why they might be there?


Note: these entries are alos in Forward Lookup Zones > ourdomain.com > forestdnszones

Also, these spoofed IP entires always seem to be after a request on port 137 from a VPN client (our vpn clients are on 192.158.254.x, 192.168.1.200 is our server)
2008-09-30 19:15:28	Local7.Info	192.168.1.99	2008 Sep 30 18:16:12 00:08:da:72:ef:60 <50000> Decrypted Inbound packet (Custom rule) Src:192.168.254.24 SPort:137 Dst:192.168.1.200 DPort:137 IPP:17 Rule:5 Interface:WAN (Internet)
2008-09-30 19:15:34	Local7.Info	192.168.1.99	2008 Sep 30 18:16:18 00:08:da:72:ef:60 <50000> Dropped Outbound packet (Spoofed IP) Src:192.168.116.1 SPort:137 Dst:192.168.254.24 DPort:137 IPP:17 Rule:-4 Interface:LAN

Open in new window

0
Comment
Question by:bradl3y
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 71

Accepted Solution

by:
Chris Dent earned 500 total points
ID: 22615497

> poert 137

NetBIOS name resolution port... so you can pretty much discard everything you see in DNS as being relevant.

> When I ping this ip address from any other workstation it times out.

If it's an additional interface on the server the client may not have a route.

> figure I should delete these entries

You might find they re-appear fairly quickly though. It depends on their origin but it's likely that they're dynamically added. You can verify that by clicking View, Advanced, then opening the properties for the record. See if it can be scavenged when it becomes stale.

Chris
0
 
LVL 6

Author Comment

by:bradl3y
ID: 22615648
Ah ha,
An IP config shows those IP addreses assigned to 2 VMWare virtual interfaces. The server only has 1 physical interface, so the server is sending packets with the IP of the VMWare interfaces in the header, how do I force it to use the real interface? Why would it be replying with the IP address of an interface that the request was not received on?
0
 
LVL 71

Assisted Solution

by:Chris Dent
Chris Dent earned 500 total points
ID: 22615737

NetBIOS... such an evil thing.

You might unbind Client for Microsoft Networks and disable NetBIOS for those two interfaces (advanced tcp/ip properties). Otherwise it will try and announce on each network interface.

That still leaves the entries registering in DNS. Is the server actually running virtual servers? Or just the service?

Chris
0
 
LVL 6

Author Comment

by:bradl3y
ID: 22616417
It is currently just running the service, but it will be used eventually. For now i unchecked those settings and disabled the adapters, i'd imagine this will fix the spoofed IP problems. In the future when I need to use vmware i will further troubleshoot to see if just disabling netbios did the trick. Thanks for the help.
0

Featured Post

Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There have been a lot of times when we have seen the need to enter a large number of DNS entries in a forward lookup zone. The standard procedure would be to launch the DNS Manager console, create the Zone and start adding new hosts using the New…
Learn about cloud computing and its benefits for small business owners.
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…
Monitoring a network: how to monitor network services and why? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the philosophy behind service monitoring and why a handshake validation is critical in network monitoring. Software utilized …
Suggested Courses

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question