We have a network with a router and an internal DNS on a Windows Server 2019. The DNS is visible to the outside via a NAT on the router (UDP 53 -> Server IP, this is required because we're a hidden-primary/authority DNS for our domain).
For some time we're receiving malicious DNS requests as part of an amplificiation attack.
We're using Response Rate Limiting as per this article using the
Set-DNSServerresponseratelimiting command ... so far so good.
Now, the same article and also another article describe a method how recursion can be limited to the internal clients only.
Essentially both articles say you turn off recursion and then add a rule that allows it for clients that match a certain criteria.
The first step is to turn recursion off:
Set-DnsServerRecursionScope -Name . -EnableRecursion $false /* or $true */
I'm testing this with a Mac with an IP of
192.168.1.149 and using a dig command like
dig -4 @server some.obscuredomain.com and checking if the dig command prints a warning that recursion is disabled. This works depending on the general setting. If I turn this on or off with the above command, the
dig command shows (or not shows) the warning about the recursion accordingly. So far so good also.
The full command sequence for disabling it and adding an exception is this:
Add-DnsServerClientSubnet -Name "Internal-24" -IPv4Subnet "192.168.1.0/24" -PassThru
Set-DnsServerRecursionScope -Name . -EnableRecursion $False
Add-DnsServerRecursionScope -Name "InternalClients" -EnableRecursion $True
Add-DnsServerQueryResolutionPolicy -Name "AllowInternal" -Action ALLOW -ApplyOnRecursion -RecursionScope "InternalClients" -ClientSubnet "EQ,Internal-24"
However, I use this sequence of commands, no matter what I do, I can not get it to be allowed to be recursive for the Mac.
I thought I may have the subnet wrong, but then for a test I just used
"NE,Internal-24", thinking that either of the two clauses should match the request (either it EQ or NE should match those requests, you're on a subnet or your're not). I also tried
-Fqdn. Apparently nothing makes a difference.