Balance 20x running firmware 8.1.1 with a Roku box behind it.
I don’t trust Roku, so I am logging its outgoing requests and I notice something unusual. The Roku is making outbound requests to Google DNS at 188.8.131.52 and 184.108.40.206 on TCP port 53 rather than UDP port 53.
The Balance 20x is doing DNS interception, that is, legacy DNS from any device on the LAN should be forced to use the DNS servers in the router. Specifically:
network → network settings → DNS proxy is enabled and Include Google Public DNS Servers is disabled
network → service forwarding → DNS Forwarding is enabled
The router is not using Google for DNS.
So, I wonder what is leaving the WAN port. Are the TCP requests to Google DNS being intercepted by the router or not? Turns out, they are not intercepted.
I know this because the Balance 20x sits behind a Surf SOHO also running 8.1.1. I set the B20x to log every outgoing request from the Roku box. I set the Surf SOHO to log both TCP and UDP to port 53 from the Balance 20x. Here are the log entries
Mar 19 11:03:59 Firewall: Allowed CONN=vlan
SRC=192.168.5.42 DST=220.127.116.11 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=12781 DF
PROTO=TCP SPT=36041 DPT=53 WINDOW=42340 RES=0x00 SYN URGP=0 MARK=0x3
Mar 19 11:03:59 Firewall: Allowed CONN=lan
SRC=192.168.2.8 DST=18.104.22.168 LEN=60 TOS=0x00 PREC=0x00 TTL=62 ID=12781 DF
PROTO=TCP SPT=36041 DPT=53 WINDOW=42340 RES=0x00 SYN URGP=0 MARK=0x2
nmap shows that 22.214.171.124 has TCP port 53 open. Here is the output of a quick scan
Starting Nmap 7.91 ( https://nmap.org ) at 2021-03-19 11:24 Eastern Daylight Time
Nmap scan report for dns.google (126.96.36.199)
Host is up (0.058s latency).
Not shown: 98 filtered ports
PORT STATE SERVICE
53/tcp open domain
443/tcp open https
It seems that Roku has successfully evaded the router rule on DNS and forced the use of Google DNS.
Is there anything I can do about this?
Should the router also be intercepting TCP port 53?
Off-topic: It seems you can block outbound TCP port 2350, which Roku often uses, without any noticeable effect.