How to block external access to the DNS service running on a Cisco router?

Question

I have a Cisco (877) router acting as the main gateway for a network; it has a DSL connection and performs NAT from the internal network to its external, public IP address.

The router allows SSH access for management, and this has been limited using an access list:

access-list 1 permit <internal network range>

line vty 0 4
    transport input ssh
    access-class 1 in

The router's internal web server isn't enabled, but if it was, I know its access could be limited using the same logic:

ip http access-class 1

Now, the gotcha: this router also acts as a DNS server, forwarding queries to external servers:

ip name-server <ISP DNS 1>
ip name-server <ISP DNS 2>
ip dns server

My problem is: the router is perfectly happy to answer DNS queries when receiving them on its external interface.

How can I block this kind of traffic so that the router only answers DNS queries from the internal network?

Solution

!Deny DNS from Public 
 ip access-list extended ACL-IN_FROM-WAN
  remark allow OpenDNS lookups
  permit udp 208.67.222.222 0.0.0.0 any eq domain
  permit tcp 208.67.220.220 0.0.0.0 any eq domain
  remark deny all others and log the attempts
  deny   udp any any eq domain log
  deny   tcp any any eq domain log
  permit ip any any

! Apply to WAN interface
 int WAN
  ip access-group ACLIN-TO_WAN in

Comments

[Massimo]

Ok, so this is not to be handled at the service level (like SSH and HTTP) but at the interface level?

[ETL]

I really don't see any other way.

[Massimo]

I tried, but there's a problem: I can successfully block incoming UDP/53 packets on the external interface... but then DNS replies from Internet DNS servers are blocked too!

[ETL]

Maybe post your ACL and how you applied it.

[Massimo]

A deny for UDP/53 packets coming from anywhere, applied as an input ACL to the external interface. Unfortunately, UDP is connectionless, thus the router can't tell if a packet is a new DNS query coming from a complete stranger, or an answer to a query it started iself...

[ETL]

When you say "DNS replies are blocked" you mean of the PCs on the inside right? So you should be able to make the ACL allow those but deny packets to the external interface.

[Massimo]

No, no, I'm talking about when the router performs a DNS query to an external server (remember, it's acting as a DNS forwarder to my ISP). But then it can't get its reply back. Even a ping to an external name from the router itself doesn't work, because it's unable to resolve the name.

[ETL]

@Massimo - check out my edit.

[Snowlockk]

While in theory this answers the question it would be best if you explained what this is.

[Massimo]

This ACL works, but it causes a problem: it's impossible to perform DNS queries to any other server from inside the network, because the reply can't come back. How can this be avoided?

[Massimo]

Sorry, this is completely wrong. This ACL would also block DNS replies from reaching the router when it (or some machine inside the LAN) performs DNS queries to external servers, effectively blocking DNS resolution.

[user3524983]

Sorry YOU are completely wrong. This is ACL Lists 101. Man, perform your due diligence before you ding somebody. This is exactly the setup I run. I know it works.