BSNL intercepting in-bound DNS traffic over port 53?

Last night I was just curious and did a simple default nmap scan of my BSNL public IPv4 address from another network and I was surprised to see that port 53 is open.
I tried querying with dig and it did return a response. Quickly I reviewed my firewall rules and by default, everything is blocked and there is no rule allowing port 53 traffic. But I could still query my public IP address and get valid responses from an external non-BSNL network. I then shut down the dnsmasq instance but I could still get a valid response.

Then I tried an nmap scan of another IP address which doesn't even ping and looks un-allocated as of now. Even that responds to DNS requests. It appears to me they are intercepting any port 53 traffic on their IP space and redirecting it to some other working resolver. Please note this is only for inbound requests ie from the external internet to BSNL.

The below is an IP address that was allocated to me before which is now in the pool and doesn't appear to be allocated to anybody yet.

[root@varkey-minipc ~]# nmap -Pn 117.215.188.107

Starting Nmap 6.40 ( http://nmap.org ) at 2020-04-05 15:47 IST
Nmap scan report for 117.215.188.107
Host is up (0.077s latency).
Not shown: 999 filtered ports
PORT   STATE SERVICE
53/tcp open  domain

Nmap done: 1 IP address (1 host up) scanned in 3.89 seconds

[root@varkey-minipc ~]# dig google.com +short @117.215.188.107
172.217.167.174
[root@varkey-minipc ~]# dig dns.google +short @117.215.188.107
8.8.4.4
8.8.8.8
[root@varkey-minipc ~]#

However, it appears to work only from Indian source IP addresses. Cause I tried querying from my VM with Hetzner, but it fails.

root@s1 ~ # nmap -Pn 117.215.188.107

Starting Nmap 7.60 ( https://nmap.org ) at 2020-04-05 12:18 CEST
Nmap scan report for 117.215.188.107
Host is up (0.40s latency).
All 1000 scanned ports on 117.215.188.107 are filtered

Nmap done: 1 IP address (1 host up) scanned in 9.21 seconds
root@s1 ~ # dig dns.google +short @117.215.188.107

; <<>> DiG 9.11.3-1ubuntu1.11-Ubuntu <<>> dns.google +short @117.215.188.107
;; global options: +cmd
;; connection timed out; no servers could be reached
root@s1 ~ #

 

[shashankb]

@abbyck What to look for in the dig result . I performed the dig test to google.com with my public ip

dig google.com 117.207.2xx.xxx

; <<>> DiG 9.11.3-1ubuntu1.12-Ubuntu <<>> google.com 117.207.2xx.xxx
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1999
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;google.com.            IN    A

;; ANSWER SECTION:
google.com.        300    IN    A    172.217.27.206

;; Query time: 84 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Sun Aug 23 11:35:39 IST 2020
;; MSG SIZE  rcvd: 55

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 3404
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;117.207.2xx.xxx.        IN    A

;; Query time: 194 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Sun Aug 23 11:35:39 IST 2020
;; MSG SIZE  rcvd: 44

And for WAN blocking this is what I have

 

[sloj]

You simply performed 2 queries. Use @ with your external IP address in the command.

 

[JB701]

yep lol, this is a mistake I used to make when doing dig. Because on nslookup you don't need to do @ to specify DNS Server.

 

[shashankb]

Here is the updated dig result

dig bing.com @117.207.2xx.xxx

; <<>> DiG 9.11.3-1ubuntu1.12-Ubuntu <<>> bing.com @117.207.2xx.xxx
;; global options: +cmd
;; connection timed out; no servers could be reached

This is what I get

 

[JB701]

looks like just an open port with no DNS server on it.

 

[shashankb]

Well quite relieved now , will BSNL close the port if I inform them ?

 

[shin]

If they understand what "port" is and if they care enough, maybe.

 

[Adithya]

It's not just port 53 , TCP scans show all as closed, but never thought of UDP.




Source

Source

 

[JB701]

They may have screwed up the firewall rules.

 

[shashankb]

Are those getting filtered at your side or BSNL's side ? Is there a way to know it

If some hacker puts a scan of IP range of 117 series which bsnl uses , he will find a lot of things