2

A customer is sending queries against DNS root-servers on my recursive DNS server. I need to block it with iptables. I tried 3 examples but it is not working.

0     0 DROP       udp  --  *      *       1.111.111.111        0.0.0.0/0            udp dpt:53 STRING match  "a.root-servers.net" ALGO name kmp TO 65535 /* root */
0     0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 u32 "0x1c&0xf8=0x0" STRING match  "a.root-servers.net" ALGO name bm FROM 40 TO 65535
0     0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 STRING match  "a.root-servers.net" ALGO name bm TO 65535

Any suggestion?

  • I also recommend not posting your real public IP addresses. – Rui F Ribeiro Dec 13 '15 at 21:41
  • 1
    BIND? why not blocking it on the DNS server or implementing rate limiting? Your problem is that you are forgetting DNS is UDP and TCP. – Rui F Ribeiro Dec 13 '15 at 21:56
  • Hi, Thanks for editing the IP. It is not BIND is PowerDNS and at first glance seems does not have rate limit as default function. It support LUA scripting but I don't know it. The queries against root server are all in UDP Thanks – Federi Dec 13 '15 at 21:57
  • What is the exact IPtable command you are using? It should be iptables -I INPUT -s 1.111.11.111 -j DROP – Rui F Ribeiro Dec 13 '15 at 21:59
  • Unfortunately that is NAT IP with 90 customers behind it. I cannot block the IP. I need to block only DNS queries for root server a – Federi Dec 13 '15 at 22:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.