{"id":455207,"date":"2025-04-08T21:00:51","date_gmt":"2025-04-08T21:00:51","guid":{"rendered":"http:\/\/savepearlharbor.com\/?p=455207"},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-29T21:00:00","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=455207","title":{"rendered":"A Tale of How Not to Turn Your Cisco Router into a Public DNS and NTP Server by Accident<\/span>"},"content":{"rendered":"
<\/div>\n
\n
\n
\n
\n

The Cisco IOS\/IOS-XE operating system is a source of inspiration for many other vendors. The internet is full of guides on how to configure a typical Cisco router for SOHO<\/abbr> scenarios. However, unlike consumer-grade routers, configuring something like Cisco IOS requires caution. If you don\u2019t think things through, the router may start «living its own life» and end up, for instance, as a DDoS amplification<\/a> tool.<\/p>\n

<\/figure>\n

Generally speaking, Cisco IOS-based equipment isn\u2019t a frequent guest in SOHO environments. The main obstacle is the price: for the same money, consumer-grade «boxes» offer more attractive specs. Still, Cisco does occasionally show up in SOHO setups.<\/p>\n

Let\u2019s clarify: when we say IOS, we also mean IOS-XE. And let\u2019s agree on this upfront \u2014 don\u2019t mindlessly copy-paste from this article. First, review the documentation for any commands you’re going to use.<\/p>\n

IOS includes a built-in firewall, but it’s disabled by default. Enabling the firewall (especially a zone-based firewall) introduces a set of intricacies that not everyone is ready to deal with. As a result, most people just leave the router without a firewall at all.<\/p>\n

In general, living without a firewall is not catastrophic. But it\u2019s worth remembering that any enabled services will be exposed not only to the local network but also to the public internet \u2014 including DNS, NTP, HTTP, SSH, Telnet, etc. While L2 services like CDP pose minimal risk, others are more critical. So if you\u2019re skipping the firewall, at the very least you should restrict access to sensitive services at the service level. Most of them support access restrictions via ACLs.<\/p>\n

A basic SOHO config usually has the following traits:<\/p>\n