Karl
Fri Dec 19 06:53:41 CST 2003
It's not mandatory to do so, but doing this improves your security somewhat,
because you get to prevent a virus or trojan on the computer from using that
port to send data outbound, might help prevent workstations from being
directed to a hostile DNS server that serves up bogus data that redirects
the user to a malicious or spoofed web site through a number of DNS attacks,
etc. You do it because it's unnecessary to allow all those workstations to
talk to the internet on that port. Also, you get to block or redirect
resolution for certain domains, such as blocking AOL AIM by adding an empty
oscar.aol.com or resolving it to 127.0.0.1 or to a firewall that alerts when
someone is infected by a virus that tries to go to www.virus.com You may
get a small reduction in Internet bandwidth and increase in internet speed
as DNS entries are cached locally. etc. etc.
"Scar" <anonymous@discussions.microsoft.com> wrote in message
news:011401c3c5f9$56febed0$a001280a@phx.gbl...
> Why should I not allow all my workstaions to query DNS
> directly on the internet and why should only the DNS
> servers be able to access external DNS queries through
> the firewall