I am having trouble with my DNS and NTP settings getting bypassed

[someone]

Firewall rules
443 IN tcp
53 In udp
Thats it
I am constantly hit on port 0, anyone know how to block it, unless its stateful, I havnt seen a way
Of course also ports 80,8081, 22, 23, and server ports, 123 and its not NTP and some others
Hit with constant syn, acks, rst, syn ack, etc with high starting sequence numbers that I think
stateful firewall would block but suricata catches them first from blocklists, 25 percent
of my blocklist from varied sources, and my custom blocklist catch 75 percent
But not all and they are auto IPs spoofed
thanks

[someone]

443 In tcp
53 in udp
thats it
thanks

[Patrick M. Hausen]

Remove these, they are dangerous and not necessary. Why would you open DNS to the world?

[someone]

How I fixed it
I reloaded
Set unbound settings
Set DNS servers in system > general
Disabled firefox DNS
Is now working correctly so far
There were a few changes in unbound
Enable DNS sec support
I have listen port on 853 for quad9 but its using 53
Flush Dns cache on reboot
And aggressive nsec
enabled query forwarding for dns.quad9.net at 9.9.9.9
but at the top it is using the DNS servers I listed in system > general
8.8.8.8,8.8.4.4,9.9.9.9
Probably why quad9 is using 53 instead of 853
enabled DNS over TLS with dns.quad9.net also on port 853
also at the top shows DNS servers set in system > general
havnt changed it yet
also made snapshot
doing good so far even if using 53

[someone]

I will try that
I think it wasnt working when I didnt open those ports but will try again
It hits outbound servers on those ports
 Inbound response is usually a high port number and covered by stateful firewall lets it in
Thanks I will definitely close that if I can
I will check the DHCP response
And the syn and rst packets response
I think ack is on the established port
And icmp
I will try it
thanks

[someone]

Thanks, its working with no wan firewall rules but defaults
That closes a security hole, thanks
I unchecked the box in unbound query forwarding to use system DNS servers
So it uses the settings in Query forwarding and DNS over TLS
Did a reboot
But it is using quad9 but still outgoing 53 instead of 853 to quad9, but works
Maybe 853 is a subscription thing, will have to check
thanks