Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i am currently experiencing a DNS reflection attack towards my server. I am getting a massive amount of answers via UDP from Port 53 that my server has never asked for:

02:53:57.626156 IP (tos 0x0, ttl 50, id 0, offset 0, flags [DF], proto UDP (17), length 267) REFLECTING.OPEN.DNS.SERVER.domain > mydomain.com.11803: 30781- q: RRSIG? . 0/13/1 ns: . NS A.SOMENAMESERVER.NET., .[|domain]

02:53:57.626382 IP (tos 0x0, ttl 50, id 0, offset 0, flags [DF], proto UDP (17), length 267) REFLECTING.OPEN.DNS.SERVER.domain > mydomain.com.11803: 30781- q: RRSIG? . 0/13/1 ns: . NS B.SOMENAMESERVER.NET., .[|domain]

02:53:57.627804 IP (tos 0x0, ttl 50, id 0, offset 0, flags [DF], proto UDP (17), length 267) REFLECTING.OPEN.DNS.SERVER.domain > mydomain.com.24188: 30781- q: RRSIG? . 0/13/1 ns: . NS C.SOMENAMESERVER.NET., .[|domain]

So the countermeasure i thought about is limiting the number of incoming Packets with a source port of 53. Should be no problem with iptables right?

So i put this together with my little iptables skills:

-A INPUT -s A.TRUSTED.NAMESERVER -j ACCEPT

-A INPUT -s B.TRUSTED.NAMESERVER -j ACCEPT

-A INPUT -s C.TRUSTED.NAMESERVER -j ACCEPT

-A INPUT -p udp -m udp --sport 53 -m limit --limit 10/min -j LOG --log-prefix "53 DENY FROM: " --log-level 7

-A INPUT -p udp -m udp --sport 53 -m limit --limit 10/min --limit-burst 20 -j ACCEPT

Logging the attack and bursting it when it gets too much. Well i would not write here if it worked out.

Something must be wrong and i cant figure out what. It logs correctly but it doesn't DROP any packages even if the number is > burst limit.

I am very thankful for help.

Greets Marcel

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

I can't see any DROP in your rules. Perhaps you want to append

-A INPUT -p udp -m udp --sport 53 -j DROP

at the end of your rules?

share|improve this answer
    
oh my... ofcourse how could i be so blind... thanks a lot! now it works! –  Marcel Jan 31 '13 at 13:09
    
how about accepting my answer then? I'm trying to gain some reputation in here :-) –  mateusz.kijowski Jan 31 '13 at 13:18
    
i couldnt do it before for some reason it said wait 7 minutes - so i did :) –  Marcel Jan 31 '13 at 13:28
    
thanks, now I can paste more links in answers! :-) –  mateusz.kijowski Jan 31 '13 at 13:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.