Dns Overview; Dns Server Address Assignment; Configuring The Dns Screen - ZyXEL Communications ZyWall 110 User Manual

36.6 DNS Overview

DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and
vice versa. The DNS server is extremely important because without it, you must know the IP
address of a machine before you can access it.

36.6.1 DNS Server Address Assignment

The ZyWALL/USG can get the DNS server addresses in the following ways.
• The ISP tells you the DNS server addresses, usually in the form of an information sheet, when
you sign up. If your ISP gives you DNS server addresses, manually enter them in the DNS server
fields.
• If your ISP dynamically assigns the DNS server IP addresses (along with the ZyWALL/USG's WAN
IP address), set the DNS server fields to get the DNS server address from the ISP.
• You can manually enter the IP addresses of other DNS servers.

36.6.2 Configuring the DNS Screen

Click Configuration > System > DNS to change your ZyWALL/USG's DNS settings. Use the DNS
screen to configure the ZyWALL/USG to use a DNS server to resolve domain names for ZyWALL/
USG system features like VPN, DDNS and the time server. You can also configure the ZyWALL/USG
to accept or discard DNS queries. Use the Network > Interface screens to configure the DNS
server information that the ZyWALL/USG sends to the specified DHCP client devices.
A name query begins at a client computer and is passed to a resolver, a DNS client service, for
resolution. The ZyWALL/USG can be a DNS client service. The ZyWALL/USG can resolve a DNS
query locally using cached Resource Records (RR) obtained from a previous query (and kept for a
period of time). If the ZyWALL/USG does not have the requested information, it can forward the
request to DNS servers. This is known as recursion.
The ZyWALL/USG can ask a DNS server to use recursion to resolve its DNS client requests. If
recursion on the ZyWALL/USG or a DNS server is disabled, they cannot forward DNS requests for
resolution.
A Domain Name Server (DNS) amplification attack is a kind of Distributed Denial of Service (DDoS)
attack that uses publicly accessible open DNS servers to flood a victim with DNS response traffic.
An open DNS server is a DNS server which is willing to resolve recursive DNS queries from anyone
on the Internet.
In a DNS amplification attack, an attacker sends a DNS name lookup request to an open DNS
server with the source address spoofed as the victim's address. When the DNS server sends the
DNS record response, it is sent to the victim. Attackers can request as much information as possible
to maximize the amplification effect.
Configure the Security Option Control section in the Configuration > System > DNS screen
(click Show Advanced Settings to display it) if you suspect the ZyWALL/USG is being used (either
by hackers or by a corrupted open DNS server) in a DNS amplification attack.
Chapter 36 System
ZyWALL/USG Series User's Guide
664