Virgin Media Community

[ravenstar68]

While you might know your way around your router - that does not make you an expert on networking if I may say so.

You're getting the mDNS letter because something on your network is responding to an mDNS probe from OUTSIDE your network.  These probes along with other types of probe are sent by an organisation called Shadowserver, who's aim is to encourage organisations and individuals to close down these holes.

Many of these scan types probe vulnerabilities that can be used to include your system as part of a DDOS attack against a third party without your knowledge.

Blocking Outbound mDNS is not the problem, indeed depending on how it's done, it can cause  more problems then it solves.

My solution for devices in the DMZ was to create a port forwarding rule that routes the inbound packets to a different port to 5353.  This is because mDNS ONLY listens on that port.  On the Hub 3 at least port forwarding rules are applied BEFORE the DMZ is considered.  So by doing this I was effectively forcing my PC to drop the inbound mDNS packets from outside the network (as I chose a port that the PC doesn't listen on).

However mDNS packets generated from devices inside my network still continue to reach their targets (i.e. other devices on my LAN)

Note that Shadowserver ONLY see a positive when they get an mDNS response back from a query sent to your PUBLIC IP.  Virgin Media don't monitor your outbound traffic, they respond to notifications from Shadowserver that your IP address has responded to their queries.

Tim

[gonepearshaped]

@ravenstar68. Actually I used to be a network engineer.

I do not have any DMZ set up and as mentioned I have 1 port open which is not mDNS related. Upnp also isn't enabled, and looking at the active NAT sessions there is no port 5353 open.

Using https://hackertarget.com/udp-port-scan/ you can see that the port is effectively dropped so as mentioned in my email, unless Shadowserver is intercepting outbound requests I'm not sure how they've come to the conclusion that I'm open to mDNS queries.

As per standard firewall rules, open/filtered means there's no response on that port.

Starting Nmap 7.40 ( https://nmap.org ) at 2018-12-19 09:40 UTC
Nmap scan report for X.X.X.X
Host is up.
PORT      STATE         SERVICE
53/udp    open|filtered domain
69/udp    open|filtered tftp
123/udp   open|filtered ntp
161/udp   open|filtered snmp
1900/udp  open|filtered upnp
5353/udp  open|filtered zeroconf
11211/udp open|filtered memcache

k

[ravenstar68]

Well my suggestion at this point would be to ask Shadowserver if they can provide you with the mDNS response string seen, as well as ask them to check directly if they can still see mDNS responses from your public IP.  That way you cut out the middleman as it were.

Certainly, when I asked them for the information, they did provide it.

Details on Shadowserver's mDNS project can be found here, including how to contact them.

https://mdns.shadowserver.org/

TIm

Edit 5353 shouldn't show in an active NAT session, while the mDNS RFC DOES allow for responses from remote IP addresses, in practice all transactions should only really be on the local network and not cross the LAN/WAN boundary.