1

Basically I'm getting tons of request to my named/bind service, basically those requests are being rejected by named, Those are the messages i get, from tons of ips., How extacly can I drop those requests insted of rejecting them , Thanks in Advance.

Jan 20 16:43:01 lexneva named[2704]: client 66.230.160.1#7699: query (cache) './NS/IN' denied
Jan 20 16:43:01 lexneva named[2704]: client 66.230.160.1#13391: query (cache) './NS/IN' denied
Jan 20 16:43:02 lexneva named[2704]: client 66.230.128.15#43014: query (cache) './NS/IN' denied
Jan 20 16:43:04 lexneva named[2704]: client 66.230.128.15#45178: query (cache) './NS/IN' denied
2
  • Why do you want that? Are you hitting any resource limits? It is part of the protocol to deny these requests. Apr 12, 2015 at 11:27
  • Yes sir, they are spamming my server i do not want to reject, i want to drop those requests
    – Gsa
    Apr 12, 2015 at 11:42

2 Answers 2

0

There are at least a couple ways you could achieve that.

I've seen examples of using iptables with its string/bytes-matching functionality to look for recursive queries coming from outside, and then dropping them. I've a colleague that did that on an authoritative non-recursive server for a number of years and he said it works well.

I've also seen people using something like fail2ban to look at the logs, determine that an evil IP/subnet was doing something undesirable, and let it put in rules to block the client at the firewall.

2
-1
#> iptables -I INPUT -s 66.230.160.1 -j DROP
#> iptables -I INPUT -s 66.230.160.15 -j DROP
4
  • I wish it was one ip bro, it like crazy plenty of ip's
    – Gsa
    Apr 12, 2015 at 13:26
  • haha that's no fun. You can drop an entire subnet : iptables -I INPUT -s 66.230.160.0/24 -j DROP
    – Ethode
    Apr 12, 2015 at 13:30
  • they are not attacking from same subnet lol,.... this is just stupid., this guy probably got plenty of zombies or whatever
    – Gsa
    Apr 12, 2015 at 15:08
  • You could setup a flood limit on the BIND port which will essentially act as a DNS only ddos control and you could setup the rules and then change the threshold
    – Ethode
    Apr 13, 2015 at 0:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .