I got an Ubuntu 19.10 VPS server which is serving some users for a certain monitoring traffic. Users connect, read a file and disconnect. Recently I noticed the aforementioned server is being used in DNS DDoS amplification attacks by simply replying to DNS requests from botnets or pests as such so I tried defining some IPTABLES rules like:
root@brohams ~# iptables-save -c
# Generated by iptables-save v1.6.1 on Mon Oct 14 09:26:44 2019
*filter
:INPUT ACCEPT [5748921:3396057055]
:FORWARD ACCEPT [2209544:2701483932]
:OUTPUT ACCEPT [6194165:6573791719]
[0:0] -A INPUT -i eth0 -p udp -m udp --dport 53 -j DROP
[182468:7298720] -A INPUT -i eth0 -p tcp -m tcp --dport 53 -j DROP
[40:1692] -A INPUT -i eth0 -p tcp -m tcp --dport 25 -j DROP
[2398:136716] -A INPUT -i eth0 -p tcp -m tcp --dport 22 -j DROP
[0:0] -A INPUT -i eth0 -p udp -m udp --dport 53 -j DROP
[0:0] -A INPUT -p udp -m udp --dport 53 -j DROP
COMMIT
# Completed on Mon Oct 14 09:26:44 2019
# Generated by iptables-save v1.6.1 on Mon Oct 14 09:26:44 2019
*nat
:PREROUTING ACCEPT [892666:157568071]
:INPUT ACCEPT [144360:14788753]
:OUTPUT ACCEPT [6862:425179]
:POSTROUTING ACCEPT [1:78]
[59:3020] -A PREROUTING -p tcp -m tcp --dport 53 -j DNAT --to-destination 8.8.8.8
[339793:21781969] -A PREROUTING -p udp -m udp --dport 53 -j DNAT --to-destination 8.8.8.8
[0:0] -A PREROUTING -p tcp -m tcp --dport 53 -j DNAT --to-destination 8.8.8.8
[0:0] -A PREROUTING -p udp -m udp --dport 53 -j DNAT --to-destination 8.8.8.8
[27192:4136927] -A POSTROUTING -s X.X.X.0/24 -o eth0 -j MASQUERADE
[336369:21533218] -A POSTROUTING -o eth0 -j MASQUERADE
[0:0] -A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Mon Oct 14 09:26:45 2019
Here is the output of iptables -Lnv:
root@brohams ~# iptables -L -n -v
Chain INPUT (policy ACCEPT 9417K packets, 5055M bytes)
pkts bytes target prot opt in out source destination
0 0 DROP udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53
287K 11M DROP tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
62 2668 DROP tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25
686 31144 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 8
0 0 DROP udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:53
Chain FORWARD (policy ACCEPT 5106K packets, 5409M bytes)
pkts bytes target prot opt in out source destination
857K 61M ACCEPT all -- xx0 * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 10M packets, 11G bytes)
pkts bytes target prot opt in out source destination
Interestingly enough, incoming UDP DNS request packets are not being dropped and my server is still answering them. TCP DNS requests are being dropped as you can see. My OS version is:
root@brohams ~# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 19.04
Release: 19.04
Codename: disco
root@brohams ~# uname -romi
5.0.0-31-generic x86_64 x86_64 GNU/Linux
And my IPTABLES version is:
root@brohams ~# iptables -V
iptables v1.6.1
UPDATE
I noticed a lot of DNS queries reach my machine which are having a different destination IP address than my VPS.
root@brohams ~# tcpdump -s0 -vvvvni eth0 port 53 | grep -i ddosvictim
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
172.217.40.8.36059 > x.x.179.4.53: [udp sum ok] 10363% [1au] A? victim.com. ar: . OPT UDPsize=4096 DO (57)
74.125.190.150.65259 > x.x.179.4.53: [udp sum ok] 4809% [1au] SOA? victim.com. ar: . OPT UDPsize=4096 DO (57)
141.101.70.60.59972 > x.x.179.4.53: [udp sum ok] 4272 [1au] A? victim.com. ar: . OPT UDPsize=1452 (46)
76.96.47.215.6328 > x.x.179.4.53: [udp sum ok] 38615 [1au] ANY? www.victim.com. ar: . OPT UDPsize=4096 DO (50)
64.135.1.20.28270 > x.x.179.4.53: [udp sum ok] 38218% [1au] AAAA? ns1.victim.com. ar: . OPT UDPsize=4096 DO (50)
As you can see, there are all sorts of requests in a large volume, thousands (output omitted for brevity). The fact that these packets even end up on my VPS is really mind bugling. Why should this happen?
This is when I query my own server, we can see my PREROUTING NAT is doing what it is told:
root@brohams ~# tcpdump -s0 -vvvvni eth0 port 53 | grep -i distro
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
My.PC.83.162.36180 > My.VPS.183.141.53: [udp sum ok] 6595+ [1au] A? distrowatch.com. ar: . OPT UDPsize=4096 (56)
My.VPS.183.141.36180 > 8.8.8.8.53: [udp sum ok] 6595+ [1au] A? distrowatch.com. ar: . OPT UDPsize=4096 (56)
8.8.8.8.53 > My.VPS.183.141.36180: [udp sum ok] 6595 q: A? distrowatch.com. 1/0/1 distrowatch.com. [2h28m26s] A 82.103.136.226 ar: . OPT UDPsize=512 (60)
My.VPS.183.141.53 > My.PC.83.162.36180: [udp sum ok] 6595 q: A? distrowatch.com. 1/0/1 distrowatch.com. [2h28m26s] A 82.103.136.226 ar: . OPT UDPsize=512 (60)
This machine has not been configured as any type of DNS server. It just acts as a recursive DNS server for VPN users that rarely connect to it, but it is crucial for them to have this function. Also it has only one interface (Eth0).
I could not find any bugs reported for this version of IPTABLES. Any idea why this type of traffic is still passing through and how to stop it?
P.S. I have tried re-adding the rule or move it around but it is still the same.
Thanks in advance
