Back story: I've got a domain controller exposed to the internet (I know, it shouldn't be, was put together piecemeal). Unfortunately, we just discovered that it's being used in LDAP reflection attacks. We're only using this for active directory, not much DNS work going on.
I can't make many changes to the physical infra at this stage and just want to limit requests hitting port 389 via UDP/TCP to LAN IPs only. I'm trying to limit issues and downtime as it's a high traffic environment.
I did notice in Resource Monitor > Network > TCP Connections, the public IPs for the other servers in the domain showing on port 389. I was under the impression communication to the AD was via the 10.1.1.x.
Questions:
Can I add only the LAN IP range 10.1.1.0/24
to the firewall rule for port 389 without breaking other AD/DC functionality?
Why would I see connections to the AD from other servers with their public IP?