up vote 2 down vote favorite
1
share [g+] share [fb]

I am having a public DNS that I want to protect against some kind of attackers that are hitting my DNS server every single seconds with the same domain entry. I do it for the moment based on iptables rules but I would like to know if there is an automatic system we could use for that purpose. I have in mind fail2ban for http, is there anything out there like this for DNS queries?

Thank you!

link|improve this question
6  
One query per second is very minimal. How many legitimate queries do you see ? – adaptr Dec 20 '11 at 15:25
feedback

3 Answers

up vote 4 down vote

fail2ban is not "for http", it's a framework for taking actions (like banning IPs at the firewall) based on log entries. Here are the relevant configuration options from my DNS server:

named.conf

logging {
        channel default_file {
                file "/var/log/named.log" size 10m;
                severity info;
                print-time yes;
                print-severity yes;
                print-category yes;
        };
        category default{ default_file; };
};

jail.local

(fail2ban's configuration file)

[named-refused-bsd-ipfw]
enabled  = true
filter   = named-refused
action   = bsd-ipfw
logpath  = /var/named/var/log/named.log
maxretry = 20
bantime = 43200

Note that this is a FreeBSD box using IPFW (firewall). You'll want to use action iptables and name the rule appropriately.

You may also need to change the log paths, depending on your installation. Note that in my example there are different paths because BIND is running in a jail (chrooted to /var/named). Running in a jail makes things more complicated, but not bad once you get used to it.

You should also setup some sort of log rotation mechanism for the log file.

newsyslog.conf

/var/log/named.log      bind:bind       644  7     *    $W6D0 J    /var/run/named/pid 1

You may also want to take a look at who it is, it may be an open resolver (like Google, 4.2.2.2-.4, etc). Banning them doesn't ban the real "attacker". You can do a reverse lookup on the IP with something like dig -x 4.2.2.4 and see if that helps.

link|improve this answer
+1 for explaining fail2ban, but adding DNS logging and using fail2ban doesn't seem like the most effective solution (lots 'o logs that will never matter!). IPtables rate limiting feels much more suited in this case. – Jeff Ferland Dec 20 '11 at 20:25
IPTables rate limiting would would catch the "good" traffic too; though you could easily combine them and rate limit the "bad" IPs instead of blocking them. Also, BIND's logging can be tuned so it doesn't dump a load a garbage in the log files. My servers typically generate a couple megabytes a week, easily manageable. – Chris S♦ Dec 20 '11 at 20:39
hashlimit allows limiting based on source IP or netblock... also with "failed" DNS queries as a normal part of operation, a client's bad behavior would be masked by constantly asking for successful responses. – Jeff Ferland Dec 20 '11 at 20:41
I'm assuming he'd want to allow a single IP to hit the server every second if it's continuously making valid requests. He seems to take exception only with the IPs getting constant rejections. IPTables alone has no way to distinguish this application layer status. A constant stream of failed requests isn't normal. – Chris S♦ Dec 20 '11 at 20:45
feedback
up vote 2 down vote

For UDP packets, I would suggest using the limit or hashlimit functions of iptables. I tend to have good success in getting packets to stop when I reject them using --reject-with icmp-admin-prohibited. (NTP server experience).

Limiting to 10,000 a day should let past all but the most unusual edge case of legitimate user on your external interface and keep the one-per-second thing from happening.

link|improve this answer
feedback
up vote 1 down vote

If you are using a dedicated server provider or recently acquired IP range, this is not uncommon.

If your DNS server is configured correctly, it should easily be able to handle a few queries/sec without too much impact on performance.

Putting in place something to block this could likely cause more problems than it resolves.

Contact Domain Owner

In some cases where this was problematic, I've contacted the domain owner (check their Whois). Let them know of the issue - they may be able to fix it for you.

Answer the Request

In really tough cases, I have actually setup records and provided results. As a result, this domain was routed to a site I selected. While this is stepping toward the black hat side of things, the issue stopped in 8 hours.

link|improve this answer
2  
+1 -- if you're going to ask me for something I don't have every second, I'm eventually going to get creative. NTP has the "Kiss of Death" packets for that. I've also found sending icmp-admin-prohibited rejections with iptables to work really well. – Jeff Ferland Dec 20 '11 at 20:16
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.