2
votes
2answers
79 views

Will MX records with a longer TTL help mitigate effects of DoS attack?

We have our email hosted at Google Apps, and have our DNS servers for the domain setup at Namecheap. About a month ago our website went down (not a big deal, since it's most just a contact info ...
12
votes
1answer
2k views

What is an open DNS resolver, and how can I protect my server from being misused by hackers?

I don't have the strongest background in computer security, but yesterday one of my company servers was shut down by our host. It's a server assigned a public IP where I host several web-service ...
2
votes
2answers
123 views

How can I mitigate DNS Server outages?

Let's say I have a root domain of "mysite.com". That domain and its sub-domains have DNS served by an external service - let's call them Setwork Nolutions. If this external company is hit with a DDoS ...
1
vote
1answer
67 views

How to setup Microsoft DNS so it does not contribute to DNS amplification attacks

I am using a Microsoft DNS server to host both our internal and external DNS. This means that recursive lookups needs to be turned on, or internal users will not be able to perform DNS queries. ...
2
votes
1answer
147 views

Received Notification of my server be involved in “DNS amplification attack”. How can I stop? [duplicate]

I just received an email from my website internet provider that my server has been "involved as open resolvers in DDoS attacks (DNS Reflection) over the past few weeks." Here is the full email: ...
0
votes
1answer
740 views

Prevent DNS responses for specific domain completely

Situation: Server (Win 2008R2) is being used in a DNS (amplification) DDoS attack. Amplification factor is already down to 1: Set the DNS server to non-recursive and removed all root hints -> DNS ...
0
votes
0answers
200 views

Block incoming DNS queries using netsh advfirewall

How do you do this with Windows firewall? iptables -I INPUT --in-interface ! lo -p udp --dport 53 -j DROP Ideally, if you can do this with netsh and so that it will survive whatever it is that ...
0
votes
2answers
686 views

How to disable access to DNS server from internet, leaving intranet intact? Using iptables

I have to manage one server with Open DNS service on. Recently, it was heavily abused for ddos dns amplification attacks by unknown internet attackers. This DNS service is used by some localhost ...
14
votes
4answers
1k views

How is it possible for the Root Name Servers to handle all DNS requests?

I was reading about DNS some days ago and learned how the requests are processed. If you surf to www.example.com, then a request will go to the Root Name Servers to see who owns that .com address, ...
0
votes
2answers
294 views

Countermeasures versus incoming DNS reflection attack

i am currently experiencing a DNS reflection attack towards my server. I am getting a massive amount of answers via UDP from Port 53 that my server has never asked for: 02:53:57.626156 IP (tos ...
10
votes
1answer
958 views

Amplified reflected attack on DNS servers

The term Amplified reflected attack is new to me, and I have a few questions about it. I've heard it mostly happens with DNS servers - is that true? How do you protect against it? How do you know if ...
-1
votes
1answer
508 views

Fail2ban memory usage

Since my server is under a sustain DNS amplification attack (DDOS), I configured fail2ban and initially my outgoing traffic dropped markedly. Anyway, after a few hours (mostly +10), fail2ban uses ...
8
votes
7answers
7k views

bind: blackhole for invalid recursive queries?

I have a name server that's publicly accessible since it is the authoritative name server for a couple of domains. Currently the server is flooded with faked type ANY requests for isc.org, ripe.net ...
12
votes
3answers
673 views

DNS down in Anonymous attack

As I'm writing this our company website and the web-service we developed are down in the big GoDaddy outage resulting from an Anonymous attack (or so says Twitter). We used GoDaddy as our registrar ...
14
votes
9answers
5k views

Public Facing Recursive DNS Servers - iptables rules

We run public-facing recursive DNS servers on Linux machines. We've been used for DNS amplification attacks. Are there any recommended iptables rules that would help mitigate these attacks? The ...
0
votes
1answer
72 views

DNS workaround for webhost DDoS [duplicate]

My webhoster seems to have some troubles with DDOS attacks and routing overload. This makes my IP to be not available sometimes and I'd like to add a failover IP for the domain. However, 2 A-Records ...
1
vote
1answer
81 views

How to get the average packet rate per ip for a port?

Is it possible with iptables to limit inbound packets by source-ip based on the number of average inbound packets for all source-ips? If so, how? I'd like to limit new ips to the average inbound ...
7
votes
6answers
3k views

lots of dns requests from China, should I worry?

I have turned on dns query logs, and when running "tail -f /var/log/syslog" I see that I get hundreds of identical requests from a single ip address: Apr 7 12:36:13 server17 named[26294]: client ...
0
votes
2answers
3k views

DNS Server Spoofed Request Amplification DDoS - Prevention

I've been conducting security scans, and a new one popped up for me: DNS Server Spoofed Request Amplification DDoS The remote DNS server answers to any request. It is possible to query the ...
-2
votes
2answers
658 views

DDoS Mitigation with round robin DNS? [duplicate]

Alright, so my friend and I are setting up a new website. We expect heavy DDoS attacks, so our plan is to use nginx to proxy from various cloud servers so that people can't find our actual server's ...
0
votes
2answers
267 views

Basic EC2 Load Balancing Concepts [duplicate]

I am creating a site that I expect to receive DDoS attacks on occasion. I have created two EBS AMIs on Amazon EC2. One AMI for a MySQL Database and one for the web host. I have added an elastic IP ...
1
vote
2answers
8k views

How do you prevent UDP-flood based DDOS attacks on a DNS server? [duplicate]

I'm studying networking at the moment, and it just occurred to me that one can easily forge DNS requests with fake IP addresses (since they use UDP). Since DNS relies on UDP for communication, ...
1
vote
4answers
639 views

Distributed web server to stop DDos attacks? [duplicate]

I have been thinking about a way to hinder DDos (Distributed Denial of Service) attacks (which seems to be a hot topic at the moment) by placing a signed Java Applet on the web site. This Java Applet ...