BSNL intercepting in-bound DNS traffic over port 53?

Last night I was just curious and did a simple default nmap scan of my BSNL public IPv4 address from another network and I was surprised to see that port 53 is open.
I tried querying with dig and it did return a response. Quickly I reviewed my firewall rules and by default, everything is blocked and there is no rule allowing port 53 traffic. But I could still query my public IP address and get valid responses from an external non-BSNL network. I then shut down the dnsmasq instance but I could still get a valid response.

Then I tried an nmap scan of another IP address which doesn't even ping and looks un-allocated as of now. Even that responds to DNS requests. It appears to me they are intercepting any port 53 traffic on their IP space and redirecting it to some other working resolver. Please note this is only for inbound requests ie from the external internet to BSNL.

The below is an IP address that was allocated to me before which is now in the pool and doesn't appear to be allocated to anybody yet.

[root@varkey-minipc ~]# nmap -Pn 117.215.188.107

Starting Nmap 6.40 ( http://nmap.org ) at 2020-04-05 15:47 IST
Nmap scan report for 117.215.188.107
Host is up (0.077s latency).
Not shown: 999 filtered ports
PORT   STATE SERVICE
53/tcp open  domain

Nmap done: 1 IP address (1 host up) scanned in 3.89 seconds

[root@varkey-minipc ~]# dig google.com +short @117.215.188.107
172.217.167.174
[root@varkey-minipc ~]# dig dns.google +short @117.215.188.107
8.8.4.4
8.8.8.8
[root@varkey-minipc ~]#

However, it appears to work only from Indian source IP addresses. Cause I tried querying from my VM with Hetzner, but it fails.

root@s1 ~ # nmap -Pn 117.215.188.107

Starting Nmap 7.60 ( https://nmap.org ) at 2020-04-05 12:18 CEST
Nmap scan report for 117.215.188.107
Host is up (0.40s latency).
All 1000 scanned ports on 117.215.188.107 are filtered

Nmap done: 1 IP address (1 host up) scanned in 9.21 seconds
root@s1 ~ # dig dns.google +short @117.215.188.107

; <<>> DiG 9.11.3-1ubuntu1.11-Ubuntu <<>> dns.google +short @117.215.188.107
;; global options: +cmd
;; connection timed out; no servers could be reached
root@s1 ~ #

 

[abbyck]

Well, I just did another scan.
Can't see 53 open now

 

[varkey]

From where did you scan @abbyck? I can still query from my Excitel connection.

 

[abbyck]

@varkey ran through my BSNL connection and Bangalore DO droplet. Also I can't resolve through any 117.* ips

 

[popcorn]

The DNS use time to propagate and also depend on network cache. This time to propagate & use of the cache is the period when the attackers inject the IP address of malicious website instead on genuine IP of the domain which is asked for. DNSSec is method to validate this. It is done at the domain registrar level where a private key is exchanged with the hosting service. The end user is not involved here. But it is always good practice of a end user to use a resolver on router which is from OpenDNS/cloudflare/google.
End user can check at this website DNSSEC Resolver Test

 

[humblefool]

Did the same test No ports are open. Tested from DO BLR
Update- Tested from Jio 4G
@varkey nmap shows all ports open

Source


From BSNL -

nmap -Pn 117.206.xx.xxx
Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-06 13:22 IST
Nmap scan report for 117.206.xx.xxx
Host is up (0.0023s latency).
Not shown: 999 filtered ports
PORT     STATE  SERVICE
5060/tcp closed sip

Nmap done: 1 IP address (1 host up) scanned in 188.63 seconds

 

[shashankb]

I just did a Open port test on my Public IP and found port 53 to be open . Is it really necessary for BSNL to keep this open ?
Btw, the test was made through Open Port Check Tool - Test Port Forwarding on Your Router
Can someone give me information on this.
DNS Hijacking is a considerable threat these days
Also I am using a BSNL Default DNS

Can you help ? @JB700 @varkey @popcorn

 

[abbyck]

@shashankb Check if DNS access from WAN is turned on on your ONU/Router.

 

[pswapneel]

@shashankb Port 53 accessible on the WAN side poses a larger threat to everyone on the Internet. It does not imply your DNS queries are being hijacked. It means, anyone on the Internet can use your public IP address as a resolver (if recursion is enabled). i.e Open resolver.

Large number of open resolvers and this has a huge impact since an open resolver can be abused for a DNS amplification attack. In the past, some of the largest DDoS attacks on Internet infrastructure have been carried out using open resolvers. As an example, check Mirai botnet attack.

One way to check whether recursion is enabled/open resolver is (this needs to be tested from outside your network)

On Linux/Unix,

dig @YOURPUBLICIP broadbandforum.co

If you get a response(IP address in the ANSWER section), it means it's an Open resolver. If not, then it means a DNS software is running on port 53 and is accessible from the internet albeit recursion.

Another empirical method to check is to use the RIPE Atlas project to run a DNS measurement with the target as YOURPUBLICIP. This method is more precise since there is a possibility that the recursion is only being allowed from specific prefixes (ISP netblock).

 

[shashankb]

@shashankb Check if DNS access from WAN is turned on on your ONU/Router.

@abbyck There is a DNS Server and a DNS Relay in my router

Default configuration is DNS Relay which uses BSNL own DNS
and DNS Server uses my custom DNS Resolver
I am using the DNS Server. Does it have anything to do with the port 53

If I change to DNS Relay , the port 53 is still open
I do not have any option to disable the DNS specifically

 

[abbyck]

@shashankb Please check if you've opened 'port 53 from WAN side' through some options in your ONU if it is not bridged, else check with your router.
Also, try dig <somedomain> @<yourpublicip> if you have access to Linux/Unix as said by @swapneelp or try with nslookup if on windows nslookup somewhere.com yourpublicip.

Try to do it from an external network. Some ONUs tend to resolve requests to public IP from internal network.