Page MenuHomeVyOS Platform
Create Task
Maniphest T523

Forwarder listening on port 53/tcp
Closed, ResolvedPublicBUG
Actions

Description

Forwarder listening on port 53/tcp on all interfaces
even if it's configured explicitly to listen on particular interfaces

How to reproduce:
Configure forwarder
bind it to certain nic
check netstat output and/or external scan output

Details

Version
1.1.8 and 1.2

Related Objects

Event Timeline

syncer created this task.Jan 17 2018, 6:20 PM
syncer assigned this task to c-po.
syncer triaged this task as Normal priority.

Want to look into that?

c-po added a comment.Jan 20 2018, 2:12 PM

Yes, can do

c-po added a comment.Jan 21 2018, 4:09 PM

After adding the bind-interfacesparameter to the configuration, movng the configuration file from /etc/dnsmasq.conf to /etc/dnsmasq.d/vyos.conf and switching to systemd, this is the result:

cpo@CR2# netstat -a | grep domain
tcp        0      0 localhost:domain        *:*                     LISTEN
tcp        0      0 lo.CR2.mucI.xxx:domain  *:*                     LISTEN
tcp        0      0 eth0.CR2.mucI.xx:domain *:*                     LISTEN
tcp6       0      0 localhost:domain        [::]:*                  LISTEN
tcp6       0      0 fe80::250:56ff:f:domain [::]:*                  LISTEN
udp        0      0 localhost:domain        *:*
udp        0      0 lo.CR2.mucI.xxx:domain *:*
udp        0      0 eth0.CR2.mucI.xx:domain *:*
udp6       0      0 localhost:domain        [::]:*
udp6       0      0 fe80::250:56ff:f:domain [::]:*
syncer added a comment.Jan 21 2018, 4:11 PM

so it still there ?
weird thing

c-po added a comment.Jan 21 2018, 4:19 PM

Nope, this is the output after binding it to eth0 only. It always binds to the loopback interface!

Dnsmasq automatically adds the loopback (local) interface to the list of interfaces to use when the --interface option is used.

syncer added a comment.Jan 21 2018, 4:21 PM

Ah ok, sorry, i'm bit slow today.
Awesome!

c-po added a comment.EditedJan 21 2018, 4:23 PM

Already triggered CI builds su it will be in tonights version.

https://ci.vyos.net/job/vyatta-op/91/changes
https://ci.vyos.net/job/vyatta-cfg-system/285/changes

c-po moved this task from Need Triage to Finished on the VyOS 1.2 Crux board.Jan 21 2018, 4:24 PM
syncer closed this task as Resolved.Jan 21 2018, 4:25 PM
syncer removed a project: VyOS 1.1.x.

thanks @c-po !

c-po mentioned this in T503: dnsmasq listen on tcp port on not selected interfaces.Mar 4 2018, 5:28 PM
syncer edited projects, added VyOS 1.1.x (1.1.8); removed VyOS 1.2 Crux.Oct 15 2018, 11:30 PM