How can I block refused packet sequences sent from bind to the same ip address by iptables?
I thought about using the string extension looking for "Refused". Would this protect the dns against DoS attack?
My attempt:
iptables -A INPUT -p udp -m udp --sport 53 -m string --string "Refused" --algo bm -m recent --set --name block-dns --rsource
iptables -A INPUT -p udp -m udp --sport 53 -m string --string "Refused" --algo bm -m recent --rcheck --seconds 10 --hitcount 1 --name block-dns --rsource -j DROP