0

We have a RHEL 6.7 DNS server and we are trying to discard packets that contain certain domains. For example, one of our DNS servers was involved in a random subdomain attack, where external hosts or other DNS servers send us queries which our server then initiates its own recursive query for a particular hostname. Each hostname queried for is invalid and random, and does not exist. From tcpdump here is what one of these queries look like.

123.123.123.123.54729 > 140.205.228.52.53: [bad udp cksum 0x3701 -> 0x0d53!] 37401 A? llij.x99moyu.net. (34)

In this example our DNS server is the 123.123.123.123 address and is handling the lookup by contacting another DNS server. We are running an older version of BIND which does not support RRL or Recursive Client Rate Limiting. We have tried rate limiting with iptables but have not gotten the results we wanted. Now we are looking into string matching with iptables but so far have had no luck with that either. I can't seem to get it to work at all. From what I have googled, it seems fairly straight-forward. Here is a rule from iptables.

-A INPUT -p udp --dport 53 -m string --algo bm --string x99moyu.net. -j DROP

And here is what it looks like from a the iptables command.

#iptables -L -vxn
 0        0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:53 STRING match "x99moyu.net." ALGO name bm TO 65535

This rule should discard any packet it sees coming into the server with the x99moyu.net. domain present (anywhere in the packet). But this is not working. The rule is at the top of the INPUT chain so I know it has to be taking precedence. I have tried taking the period off the end of the domain and putting a period in front, but that does not work either. I have also tried placing the --string x99moyu.net. before the --algo but this has no effect. I have also tried the kmp algo to no avail.

Does anyone have any experience with string pattern matching with iptables that can help and tell me what I am doing wrong?

  • DNS requests are UDP and TCP. For blocking domains, you are far much better off using RPZ, however if using an old BIND version, you wont have RPZ also. Why not upgrade to a more recent version, even if compiled by hand? – Rui F Ribeiro Dec 16 '15 at 20:09
  • Have you checked iptables is really not working? you wont stop seeing the packets coming, however they are dropped and not passed to BIND. – Rui F Ribeiro Dec 16 '15 at 20:14
  • Right now upgrading is not an option. I know iptables is not working because as you can see in my example above, no packets coming in have matched that rule, so nothings been dropped. Which is why I am asking for help in determining if my rules are somehow wrong. – user53029 Dec 16 '15 at 20:25
  • Good point about iptables – Rui F Ribeiro Dec 16 '15 at 20:31
  • I just listened to a DNS request. The last "." is not in the actual packet...it should be x99moyu.net and not x99moyu.net"." – Rui F Ribeiro Dec 16 '15 at 20:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.