Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Recently, the increased load on the DNS, to log a lot of records like this:

    14-Aug-2013 17:14:22.834 resolver: notice: DNS format error from 204.13.160.143#53 resolving palactive.com/MX for client 91.193.165.186#62572: invalid response
    14-Aug-2013 17:14:22.930 resolver: notice: DNS format error from 204.13.161.145#53 resolving transtoll.com/MX for client 91.193.165.186#62578: invalid response
    14-Aug-2013 17:14:23.026 resolver: notice: DNS format error from 204.13.161.145#53 resolving palactive.com/MX for client 91.193.165.186#62572: invalid response
    14-Aug-2013 17:14:23.125 resolver: notice: DNS format error from 204.13.160.143#53 resolving transtoll.com/MX for client 91.193.165.186#62578: invalid response
    14-Aug-2013 17:14:23.221 resolver: notice: DNS format error from 204.13.160.143#53 resolving palactive.com/MX for client 91.193.165.186#62590: invalid response
    14-Aug-2013 17:14:23.414 resolver: notice: DNS format error from 204.13.161.145#53 resolving palactive.com/MX for client 91.193.165.186#62590: invalid response
14-Aug-2013 17:42:27.882 resolver: notice: DNS format error from 64.95.64.93#53 resolving newwebtechnologies.com/MX for client 91.193.165.186#56227: invalid response
14-Aug-2013 17:42:27.999 resolver: notice: DNS format error from 64.95.64.96#53 resolving newwebtechnologies.com/MX for client 91.193.165.186#56227: invalid response
14-Aug-2013 17:42:28.114 resolver: notice: DNS format error from 64.95.64.96#53 resolving newwebtechnologies.com/MX for client 91.193.165.186#56235: invalid response
14-Aug-2013 17:42:28.230 resolver: notice: DNS format error from 64.95.64.93#53 resolving newwebtechnologies.com/MX for client 91.193.165.186#56235: invalid response
14-Aug-2013 17:42:29.091 resolver: notice: DNS format error from 204.13.161.145#53 resolving rosfar.com/MX for client 91.193.165.186#56254: invalid response
14-Aug-2013 17:42:29.296 resolver: notice: DNS format error from 204.13.160.143#53 resolving rosfar.com/MX for client 91.193.165.186#56254: invalid response
14-Aug-2013 17:42:29.501 resolver: notice: DNS format error from 204.13.161.145#53 resolving rosfar.com/MX for client 91.193.165.186#56263: invalid response

I want to add a rule to Fail2Ban to block an IP with which constantly doing such requests. Will it affect negatively on legitimate users? Help make a regular expression to Fail2Ban.

share|improve this question
1  
99% you're seeing a trojan/botnet client trying to send out spam messages. You'd be better off trying to get them to clean up their machines than banning an IP from DNS lookups because one (NAT remember) user has malware installed.. –  NickW Aug 14 '13 at 14:33
    
We have many clients from small networks that are periodically serve incoming administrators. Get rid of viruses and other malicious software from them is impossible. The main task - to reduce the load of these users on the DNS. –  Allan Sundry Aug 14 '13 at 14:46
    
Are you seriously proposing banning DNS access for the "crime" of having had an infected client on your network? NAT means one client could get hundreds banned. Why not throttle UDP. –  NickW Aug 14 '13 at 15:01
    
Is doing nothing would be more correct? If I understand correctly record a third-party IP try to use my DNS saying that the request is coming from my clients. If you block only third-party IP guess none of the customers are not affected. –  Allan Sundry Aug 14 '13 at 15:10
    
If you allow IPs that are not your clients to make recursive requests to your DNS servers, you have a much larger problem. All I am saying is that banning access to DNS due to one infected client on a LAN seems extreme to say the least. DNS is a fundamental piece of infrastructure, and when you offer recursive DNS to your clients, they should be DOSing or trying to hack it before being banned (and dropped as a client). –  NickW Aug 14 '13 at 15:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.