1

I have been getting lots of DNS requests for a while, but it would come and go sporadically. Now, it has developed into a DDOS, with several IPs sending traffic at the same time. It was saturating my internet connection on upload speed. I turned recursion off (it had been on by default), that was probably the original source of the problem. But, now, somewhere on the dark net somebody has posted that my server has (had) recursion turned on. So, then I turned on response rate limiting, with a 10 second limit. Now, I'm getting (only, ha ha!) about 6 million requests a day! This has unloaded the network connection, but my log file is reaching several hundred MB per day. The messages look like :

Jul 22 11:03:05 jelinux named[26058]: client 54.36.104.65#10683 (access-board.gov): query (cache) 'access-board.gov/ANY/IN' denied
Jul 22 11:03:05 jelinux named[26058]: client 54.36.104.65#10683 (access-board.gov): rate limit drop REFUSED error response to 54.36.104.0/24

Is there a way to reduce the amount of message traffic? I'd like to keep a report of IPs denied, but maybe just a one line report per IP every minute or so would tell me as much about number of attacking IPs and number of requests.

3

With recursion turned off you are probably already essentially a waste of the attacker's resources (you send tiny REFUSED responses instead of the big response to the ANY query they attempted, so no amplification anymore), they just haven't noticed yet that they probably would get much more out of using some other wide-open recursors instead. It might be that the flood of queries will end on its own soonish.

As you noted, the built-in mechanism in BIND is Response-Rate Limiting, which can be tweaked in different ways involving sending truncated responses to trigger real clients to switch to TCP (useful for normal responses, but you are already sending REFUSED) or dropping responses outright. It is however designed to still keep the service as available as possible, which will mean not completely shutting anyone out.

A good point from the BIND manual's RRL section (which is also applicable to any other solution which involves dropping responses) is how dropped responses on an authoritative server can make you an easier target for cache poisoning attacks:

NOTE: Dropped responses from an authoritative server may reduce the difficulty of a third party successfully forging a response to a recursive resolver. The best security against forged responses is for authoritative operators to sign their zones using DNSSEC and for resolver operators to validate the responses. When this is not an option, operators who are more concerned with response integrity than with flood mitigation may consider setting slip to 1, causing all rate-limited responses to be truncated rather than dropped. This reduces the effectiveness of rate-limiting against reflection attacks.


There are other options, such as dnsdist which you could place as a reverse-proxy in front and have it dynamically refuse or drop clients that exceed your acceptable query rate. One good thing here is that dnsdist, as the name suggest, is DNS-aware and quite flexible. So you would have the option to eg aggressively limit ANY queries alone and/or rcode REFUSED, while not affecting other queries (not affecting other queries may be based on regular rules instead).

There's also, as was noted by Michael fail2ban which could dynamically add firewall rules to block IPs based on excessive log entries. This is a bit blunt in comparison but would certainly be effective from the perspective of limiting traffic and log spam, but completely drops traffic once it triggers.

Again, for any option that involves dropping queries, do keep the above note on cache poisoning in mind.

  • Thanks very much. Looks like fail2ban would need a new jail script written. I'm hoping that now that I have recursion off, eventually this traffic will stop. No idea how long that will take, however. I'm still getting ~300 requests a second. – Jon Elson Jul 22 '18 at 17:40
  • [quote]With recursion turned off you are probably already essentially a waste of the attacker's resources [/quote] Yes, but they are still hammering me, even with RRL I'm still dealing with about 10 million requests/day. It is no longer bogging my ISP connection, but still a lot of traffic. Hopefully they will soon get the idea and bother somebody else. – Jon Elson Jul 24 '18 at 0:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.