[matrixagent]

If I'm reading the docker-compose file correctly, this creates an open dns resolver that is accessible to the outside, as Docker by default bypasses the firewall, see https://github.com/chaifeng/ufw-docker. I'm not quite sure about that, though, so I'd be happy to be corrected and learn more about how your setup works exactly.

[byteknight]

Edit: I was wrong and I'm removing it to prevent spreading false information. Please see below.

EDIT 2:

Just provided instructions in the repo for how to configure DDNS: https://github.com/IAmStoxe/wirehole#configuring-for-dynamic...

Also modified it so only the port 51820 is exposed preventing any unintentional exposure.

[dsissitka]

Are you sure? From https://docs.docker.com/compose/compose-file/:

> Either specify both ports (HOST:CONTAINER), or just the container port (an ephemeral host port is chosen).

It sounds like you get a random publicly accessible port unless you specify a non publicly accessible IP. I'm not sure whether having a DNS server listening on a non standard port would be an issue though.

[byteknight]

Sorry! I was wrong you are correct.

but nonetheless you're ingress rules in your cloud provider will not allow anything but that's single port so it's not really a big deal provided you close everything else off in your firewall.

I will make an update to see how I can work around this

[dsissitka]

> but nonetheless you're ingress rules in your cloud provider will not allow anything but that's single port...

That's all that's required for a DNS amplification attack. :)

[byteknight]

Thats not true. DNS isnt on 51820. That's wireguard. You cannot hit the DNS unless you're connected to the wireguard VPN provided you're using a cloud provider and you havent configured any additional ingress rules other than port 51820. That I am positive on.

[dsissitka]

You're right! I thought we were talking about the Pi-hole port. ><

[jradd]

You can try setting up a vpn and no tcp/udp is necessary. Pinhole could be accessed over local network.

[byteknight]

Modified it so that only port 51820 is exposed preventing any unintentional exposure.

[matrixagent]

Ahh, so as long as I only list single ports and not pairs, it is not exposed to the host, because the other number of a pair is the port to be exposed on the host. And therefor it is not exposed to the public network in this case. Makes sense, thanks for the explanation!

[NerdyBird]

This is false. Not listing the host port will make docker choose a random one. It however is still opened up in the firewall by default.

Source: https://docs.docker.com/compose/compose-file/#ports

[byteknight]

https://news.ycombinator.com/reply?id=24426759&goto=item%3Fi...

[jradd]

That’s what he said