This is the support site for Andrews & Arnold Ltd, a UK Internet provider. Information on these pages is generally for our customers but may be useful to others, enjoy!

Difference between revisions of "Stopping Open DNS - TG582N"

From AAISP Support Site
Jump to navigation Jump to search
[unchecked revision][checked revision]
m (→‎Getting rid of Open DNS Forwarder: clean up, typos fixed: from it's → from its, eg → e.g. (2))
(→‎top: clean up)
(2 intermediate revisions by one other user not shown)
Line 1: Line 1:
[[Image:T582-small.png|link=:Category:Router_TG582N|Got to Main TG582N Page]]
[[Image:T582-small.png|link=:Category:Router TG582N|Got to Main TG582N Page]]
== Getting rid of Open DNS Forwarder ==
== Getting rid of Open DNS Forwarder ==
Line 37: Line 37:
[[Category:Open DNS Resolvers]]
[[Category:Open DNS Resolvers]]
[[Category:Router TG582N]]
[[Category:Router TG582N|Stopping]]

Latest revision as of 00:59, 18 August 2018

Got to Main TG582N Page

Getting rid of Open DNS Forwarder

-This is set when AAISP configure the router.

Once the firewall is 'actually' disabled, there is now the problem that the DNS Forwarding function is now open-access to the world! This is bad because small spoofed-source UDP-packets can be sent to the router, resulting it a *large* UDP reply of the attackers' choice, a bandwidth-multiplication attack.

This can be resolved by:-

(a) On any machines with a static-IP-configuration, set their nameservers to go directly to AAISP ( and do not try to use the routers' LAN IP address.

(b) Telnet into the Router, logon to Administrator (or aaisp from the WAN side), then enter commands:-

dhcp server config state=disabled
dhcp server pool config name LAN_custom localdns=disabled
dhcp server pool config name LAN_custom primdns=
dhcp server pool config name LAN_custom secdns=
dhcp server config state=enabled
dns server config state=disabled

What this does, is tells the DHCPv4 server to directly give out the addresses of AAISP's recursive DNS servers and not its, own, and then completely disable the integral DNS forwarder (notice the DHCP server can only be reconfigured while disabled).

The router may still be wanting to use itself as a resolver for internal lookups - e.g. looking up names from its configuration such as time servers etc. Telnet in to the router and set it to use the ISPs DNS servers, e.g.:

dns client dnsadd addr= port=53
dns client dnsadd addr= port=53

NB: You can check if Legacy IP addresses are running an Open Recursive server using the website:-