I'm running my own authoritative DNS server for my own domains, and I've been dealing with an ongoing problem of DNS amplification attacks using the ANY query type. Considering the world should never have to do ANY queries against my server, I want to filter this out.
However: BIND doesn't have a mechanism for that. (I'm running BIND on Windows for this, on a multi-purpose server - the amount of queries doesn't require a fine-tuned O.S.)
I've now set up the following to work around this: A local installation of Linux in a VM to have access to iptables (which seems to be the only thing able to filter on strings in any packet) running debian (console) using a bridged eth0 interface in the same subnet as the host server.
My question: How do I setup this Linux by using iptables to filter the incoming UDP packets by string ("*") and redirect the allowed packets to the ip address of the host server?
Or, is there a (Windows server 2003) native Windows solution to achieve this? (one could hope...)
Thanks in advance!
Mark.
EDIT: ANY records are a request for "*", would that be too generic?