Allowing DNS servers to operate behind NetScreen 500

["Gebhart, Glenn" <GGebhart () chartercom com>]

All -

I have several DNS servers situated behind a NetScreen 500. As currently configured, the servers are able to send 
outbound resolution requests, but inbound resolution replies appear to be getting blocked by the firewall. 

The best solution I've been able to find so far is to allow all incoming UDP traffic to the DNS servers w/ source port 
53 and dest port > 1024. For fairly obvious reasons I'd prefer not to implement such a broad rule. 

Does anyone have a better suggestion? Ideally I'd like something akin to UDP connection tracking, where an outgoing DNS 
request installs a time-limited rule which allows the reply to traverse the firewall in the opposite direction.

Any help is greatly appreciated.
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards