I am running a server to provide DNS to my public IP subnet. I want the server to be able to get NTP, OS updates, send email, etc, but only allow incoming tcp/udp/53 from my public subnet. My goal is to block all incoming requests and only allow DNS requests incoming from my subnet 1.2.3.0/24.
Since by default it blocks all and only allows ports I open, I believe it have the ports configured correctly in the csf.conf. However, I would like to add the security of blocking everything if the request is not from my subnet.
Do I include the tcp/udp ports in the csf.conf and then only allow a subnet? Or...do I clear the port filter setting in csf.conf and create an advanced filter to accomplish this? If the advanced, I assume I would only need an entry added to the csf.allow file similar to this:
udp:in:d=53:s=1.2.3.1-1.2.3.254
Please confirm.
Thank you