Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My server (Microsoft Server 2008 R2 x64) receives about an average of 20-30 ICS.org any requests (using forged source address) per second. Recursion is disabled and the answer only contains a list of root servers. Nevertheless i recently got a complaint about unrequested dns answers by my server. So my question is

What is the easist way to configure Microsoft DNS to not answer ISC.org ANY requests?

Since this is a development server (with a free academic license), i do not want to buy any software / solution.

This are the steps i took in consideration so far:

  • Configure Microsoft DNS to prevent from answering requests for domains that it is not authoritive for - This was my first thought, but i did not find any resources about that and i don't know if thats even possible.

  • Use an iptable equivalent to drop ics.org packets via udp string match rule (found on www.minihowto.eu) - Landed on WIPFW, but there was no 64 bit version available.

  • Block IP after x udp requests / seconds on port 53 script / simple solution - did not found anything about that.

  • Using a free application level firewall for Windows Server 2008 R2 - as expected, didn't found any.

  • Using windows filtering platform for packet filtering. This was the last solution i came up with. If i understood it correctly, i would have to write a callout driver for "deep packet inspection" to find and drop ics.org any packets.

Since i have no previous knowledge in driver and wfp programming, i finally deciced to ask on SO before.

share|improve this question

closed as unclear what you're asking by Tom O'Connor Jun 28 '13 at 13:49

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

Hi I'm new to server admin but I'll try to answer this the best I can. On Server 2008 R2, when you go to your firewall rules (through server manager or however you want to go there), there are custom rules you can make for filtering by url, strings, etc. It sounds like you're posting before trying that? That's something you can try for what you're describing. Additionally, the firewall can easily be configured to block specific ports. You can click on the firewall rules and if you scroll down (or search) you'll find port 53 and dns related rules. Also, I'm wondering if you can correct this (closing or limiting traffic on 53) on the router that is the next hop outside this server (the NAT or however you have it configured).

share|improve this answer
    
I tried (and researched) a lot of things before posting - Windows Firewall does not support udp string match rules (like iptables). I don't want to block the whole port (this would make my dns server useless), i only want to filter "isc.org any" dns requests. I don't have access to the router (hosted server), so the last suggestion isn't possible. –  Dresel Oct 31 '12 at 9:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.