Tagged Questions

0
votes
0answers
80 views

Block incoming DNS queries using netsh advfirewall

How do you do this with Windows firewall? iptables -I INPUT --in-interface ! lo -p udp --dport 53 -j DROP Ideally, if you can do this with netsh and so that it will survive whatever it is that ...
0
votes
2answers
206 views

How to disable access to DNS server from internet, leaving intranet intact? Using iptables

I have to manage one server with Open DNS service on. Recently, it was heavily abused for ddos dns amplification attacks by unknown internet attackers. This DNS service is used by some localhost ...
14
votes
4answers
1k views

How is it possible for the Root Name Servers to handle all DNS requests?

I was reading about DNS some days ago and learned how the requests are processed. If you surf to www.example.com, then a request will go to the Root Name Servers to see who owns that .com address, ...
0
votes
1answer
171 views

Countermeasures versus incoming DNS reflection attack

i am currently experiencing a DNS reflection attack towards my server. I am getting a massive amount of answers via UDP from Port 53 that my server has never asked for: 02:53:57.626156 IP (tos ...
9
votes
1answer
595 views

Amplified reflected attack on DNS servers

The term Amplified reflected attack is new to me, and I have a few questions about it. I've heard it mostly happens with DNS servers - is that true? How do you protect against it? How do you know if ...
-1
votes
1answer
127 views

Fail2ban memory usage

Since my server is under a sustain DNS amplification attack (DDOS), I configured fail2ban and initially my outgoing traffic dropped markedly. Anyway, after a few hours (mostly +10), fail2ban uses ...
6
votes
4answers
2k views

bind: blackhole for invalid recursive queries?

I have a name server that's publicly accessible since it is the authoritative name server for a couple of domains. Currently the server is flooded with faked type ANY requests for isc.org, ripe.net ...
12
votes
3answers
599 views

DNS down in Anonymous attack

As I'm writing this our company website and the web-service we developed are down in the big GoDaddy outage resulting from an Anonymous attack (or so says Twitter). We used GoDaddy as our registrar ...
12
votes
9answers
2k views

Public Facing Recursive DNS Servers - iptables rules

We run public-facing recursive DNS servers on Linux machines. We've been used for DNS amplification attacks. Are there any recommended iptables rules that would help mitigate these attacks? The ...
0
votes
1answer
65 views

DNS workaround for webhost DDoS

My webhoster seems to have some troubles with DDOS attacks and routing overload. This makes my IP to be not available sometimes and I'd like to add a failover IP for the domain. However, 2 A-Records ...
1
vote
1answer
76 views

How to get the average packet rate per ip for a port?

Is it possible with iptables to limit inbound packets by source-ip based on the number of average inbound packets for all source-ips? If so, how? I'd like to limit new ips to the average inbound ...
7
votes
6answers
2k views

lots of dns requests from China, should I worry?

I have turned on dns query logs, and when running "tail -f /var/log/syslog" I see that I get hundreds of identical requests from a single ip address: Apr 7 12:36:13 server17 named[26294]: client ...
0
votes
2answers
2k views

DNS Server Spoofed Request Amplification DDoS - Prevention

I've been conducting security scans, and a new one popped up for me: DNS Server Spoofed Request Amplification DDoS The remote DNS server answers to any request. It is possible to query the ...
-2
votes
2answers
482 views

DDoS Mitigation with round robin DNS?

Alright, so my friend and I are setting up a new website. We expect heavy DDoS attacks, so our plan is to use nginx to proxy from various cloud servers so that people can't find our actual server's ...
0
votes
2answers
235 views

Basic EC2 Load Balancing Concepts

I am creating a site that I expect to receive DDoS attacks on occasion. I have created two EBS AMIs on Amazon EC2. One AMI for a MySQL Database and one for the web host. I have added an elastic IP ...
1
vote
2answers
6k views

How do you prevent UDP-flood based DDOS attacks on a DNS server?

I'm studying networking at the moment, and it just occurred to me that one can easily forge DNS requests with fake IP addresses (since they use UDP). Since DNS relies on UDP for communication, ...
1
vote
4answers
543 views

Distributed web server to stop DDos attacks?

I have been thinking about a way to hinder DDos (Distributed Denial of Service) attacks (which seems to be a hot topic at the moment) by placing a signed Java Applet on the web site. This Java Applet ...