Stopping Open DNS - TG582N
Getting rid of Open DNS Forwarder
-This is set when AAISP configure the router.
Once the firewall is 'actually' disabled, there is now the problem that the DNS Forwarding function is now open-access to the world! This is bad because small spoofed-source UDP-packets can be sent to the router, resulting it a *large* UDP reply of the attackers' choice, a bandwidth-multiplication attack.
This can be resolved by:-
(a) On any machines with a static-IP-configuration, set their nameservers to go directly to AAISP (126.96.36.199 188.8.131.52) and do not try to use the routers' LAN IP address.
(b) Telnet into the Router, logon to Administrator (or aaisp from the WAN side), then enter commands:-
dhcp server config state=disabled dhcp server pool config name LAN_custom localdns=disabled dhcp server pool config name LAN_custom primdns=184.108.40.206 dhcp server pool config name LAN_custom secdns=220.127.116.11 dhcp server config state=enabled dns server config state=disabled saveall
- Then re-test from the Control Pages: https://clueless.aa.net.uk/dnsresolvers.cgi
What this does, is tells the DHCPv4 server to directly give out the addresses of AAISP's recursive DNS servers and not its, own, and then completely disable the integral DNS forwarder (notice the DHCP server can only be reconfigured while disabled).
The router may still be wanting to use itself as a resolver for internal lookups - e.g. looking up names from its configuration such as time servers etc. Telnet in to the router and set it to use the ISPs DNS servers, e.g.:
dns client dnsadd addr=18.104.22.168 port=53 dns client dnsadd addr=22.214.171.124 port=53 saveall
NB: You can check if Legacy IP addresses are running an Open Recursive server using the website:- http://security.zensupport.co.uk/recdns/