outgoing port blocks? DNS, NTP on N600

[cameronb]

I run a linux server on my home network to provide all the services i need and since replacing my old adsl modem im having all sorts of issues. I just want an adsl router that blocks everything from outside and does NAT outgoing for all my internal services.

It seems the n600/D3600 blocks some outgoing ports, IE, my server cant directly talk to my ISP's DNS server or NTP server. Oh and i cant have my server relay email on port 25 either.

I dont want to add blanket port forwards (or if i do i want to limit the source address to only my ISP's server).

I cant find a setting to say 'just let everything INSIDE get out'

Is the list of 'blocked ports' available anywhere? Can you turn it off?

Just to add a security angle and some irony to this whole thread, from outside (ie, a hosted server on the internet) my router happily provides DNS responses. So my own router wont pass on my internal DNS packets to an external server but it will answer external DNS requests itself (this providing a vector for hacking the router or atleast using it as part of a massed botnet for DDOS attacks).

Huh?

Cam

[TheEther · Accepted solution]

AFAIK, by default there should not be any blocks for outgoing ports, provided you haven't configured anything under ADVANCED > Security > Block Services.

WRT, external DNS queries.  You are the second person I've seen to claim that your router is responding to them.  The first person posted the same here.  If this is true, then this is ripe for abuse, as you stated.  

I'm paging @ElaineM, who was checking with Netgear Engineering on this.  Elaine, this looks serious.

[TheEther · Accepted solution]

AFAIK, by default there should not be any blocks for outgoing ports, provided you haven't configured anything under ADVANCED > Security > Block Services.

WRT, external DNS queries.  You are the second person I've seen to claim that your router is responding to them.  The first person posted the same here.  If this is true, then this is ripe for abuse, as you stated.  

I'm paging @ElaineM, who was checking with Netgear Engineering on this.  Elaine, this looks serious.

[cameronb]

The *outgoing* dns problem was a brain fart on my part. My old modem was set as 10.x.x.250 and if you do that on a netgear then you cant use dhcp to allocated ports less that that it seems, so i had to change the ip of the adsl modem and i missed the static route on the server.

I confirmed the firmware was uptodate and I can still DNS query the router from outside. I have no port triggers/forwards or unblocks and no service or site blocks.

I might open a new query for the external DNS request issue.