Using port 53?

Forums › One New Zealand (including Vodafone, WxC, Farmside) › Using port 53?

dylanp

840 posts

Ultimate Geek

Trusted

#151959 11-Sep-2014 11:11

Hi everyone

In light of the recent cyber-attack on a New Zealand ISP, we’re making some changes today to ensure the continued security of our network - this includes the way we service port 53.

If you’re using port 53 (e.g. to host your own DNS server) then you will be impacted. Please call us on 0800 759 011 so we can ensure the continuity of your service. That phone number will be running for the next couple of weeks only and will take you direct to the team who will lodge a ticket to keep port 53 active for you.

Cheers

Dylan

ubergeeknz

3344 posts

Uber Geek

Trusted

Vocus

#1126420 11-Sep-2014 11:29

That's a pretty good move, honestly.

Sounddude

I fix stuff!
1928 posts

Uber Geek

Trusted

2degrees

Lifetime subscriber

#1126422 11-Sep-2014 11:30

Impressed, Good work!

clinty

1182 posts

Uber Geek

Lifetime subscriber

#1126437 11-Sep-2014 12:00

VodafoneDylan: Hi everyone

In light of the recent cyber-attack on a New Zealand ISP, we’re making some changes today to ensure the continued security of our network - this includes the way we service port 53.

If you’re using port 53 (e.g. to host your own DNS server) then you will be impacted. Please call us on 0800 759 011 so we can ensure the continuity of your service. That phone number will be running for the next couple of weeks only and will take you direct to the team who will lodge a ticket to keep port 53 active for you.

Cheers

Dylan

We have several clients that may be impacted.

What info will you require so we can source ahead of time and knock it all out in one call :)

Clint

clinty

1182 posts

Uber Geek

Lifetime subscriber

#1126442 11-Sep-2014 12:07

VodafoneDylan: Hi everyone

In light of the recent cyber-attack on a New Zealand ISP, we’re making some changes today to ensure the continued security of our network - this includes the way we service port 53.

If you’re using port 53 (e.g. to host your own DNS server) then you will be impacted. Please call us on 0800 759 011 so we can ensure the continuity of your service. That phone number will be running for the next couple of weeks only and will take you direct to the team who will lodge a ticket to keep port 53 active for you.

Cheers

Dylan

Just to confirm

Is this for Inbound (ie Internet -> Server) requests only? or will it affected DNS requests from Server -> Internet (Vodafone DNS's or Google DNS's) as well

regards,

Clint

dylanp

840 posts

Ultimate Geek

Trusted

#1126541 11-Sep-2014 14:07

clinty: Is this for Inbound (ie Internet -> Server) requests only? or will it affected DNS requests from Server -> Internet (Vodafone DNS's or Google DNS's) as well
We have several clients that may be impacted. What info will you require so we can source ahead of time and knock it all out in one call :)

Hi Clinty

I've asked around and the answers are:

The change should only affect Internet->Server queries, and should not affect Server->Internet.

There may be some customers with older DNS software which use source port 53 when making queries – these are rare, but will be affected as the responses from the Internet will destined to port 53 and are picked up by the filter.

For customers who are affected by this change (either because they are running a DNS server which is receiving queries, or because they are using source port 53 when making queries), we only need the customer IP address so we can add an appropriate exception rule.

Cheers

Dylan

hio77

12999 posts

Uber Geek

ID Verified

Trusted

Lizard Networks

#1126546 11-Sep-2014 14:10

Good to see more isps making the step to make sure they dont get hit as badly - although its not like its a new attack, its just been hit harder recently...

#include <std_disclaimer>

Any comments made are personal opinion and do not reflect directly on the position my current or past employers may have.

clinty

1182 posts

Uber Geek

Lifetime subscriber

#1126589 11-Sep-2014 14:50

VodafoneDylan:
clinty: Is this for Inbound (ie Internet -> Server) requests only? or will it affected DNS requests from Server -> Internet (Vodafone DNS's or Google DNS's) as well
We have several clients that may be impacted. What info will you require so we can source ahead of time and knock it all out in one call :)

Hi Clinty

I've asked around and the answers are:

The change should only affect Internet->Server queries, and should not affect Server->Internet.

There may be some customers with older DNS software which use source port 53 when making queries – these are rare, but will be affected as the responses from the Internet will destined to port 53 and are picked up by the filter.

For customers who are affected by this change (either because they are running a DNS server which is receiving queries, or because they are using source port 53 when making queries), we only need the customer IP address so we can add an appropriate exception rule.

Cheers

Dylan

Cheers Dylan

Appreciate the heads up

Regards
Clint