1

I got an Ubuntu 19.10 VPS server which is serving some users for a certain monitoring traffic. Users connect, read a file and disconnect. Recently I noticed the aforementioned server is being used in DNS DDoS amplification attacks by simply replying to DNS requests from botnets or pests as such so I tried defining some IPTABLES rules like:

root@brohams ~# iptables-save -c
# Generated by iptables-save v1.6.1 on Mon Oct 14 09:26:44 2019
*filter
:INPUT ACCEPT [5748921:3396057055]
:FORWARD ACCEPT [2209544:2701483932]
:OUTPUT ACCEPT [6194165:6573791719]
[0:0] -A INPUT -i eth0 -p udp -m udp --dport 53 -j DROP
[182468:7298720] -A INPUT -i eth0 -p tcp -m tcp --dport 53 -j DROP
[40:1692] -A INPUT -i eth0 -p tcp -m tcp --dport 25 -j DROP
[2398:136716] -A INPUT -i eth0 -p tcp -m tcp --dport 22 -j DROP
[0:0] -A INPUT -i eth0 -p udp -m udp --dport 53 -j DROP
[0:0] -A INPUT -p udp -m udp --dport 53 -j DROP
COMMIT
# Completed on Mon Oct 14 09:26:44 2019
# Generated by iptables-save v1.6.1 on Mon Oct 14 09:26:44 2019
*nat
:PREROUTING ACCEPT [892666:157568071]
:INPUT ACCEPT [144360:14788753]
:OUTPUT ACCEPT [6862:425179]
:POSTROUTING ACCEPT [1:78]
[59:3020] -A PREROUTING -p tcp -m tcp --dport 53 -j DNAT --to-destination 8.8.8.8
[339793:21781969] -A PREROUTING -p udp -m udp --dport 53 -j DNAT --to-destination 8.8.8.8
[0:0] -A PREROUTING -p tcp -m tcp --dport 53 -j DNAT --to-destination 8.8.8.8
[0:0] -A PREROUTING -p udp -m udp --dport 53 -j DNAT --to-destination 8.8.8.8
[27192:4136927] -A POSTROUTING -s X.X.X.0/24 -o eth0 -j MASQUERADE
[336369:21533218] -A POSTROUTING -o eth0 -j MASQUERADE
[0:0] -A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Mon Oct 14 09:26:45 2019

Here is the output of iptables -Lnv:

root@brohams ~# iptables -L -n -v
Chain INPUT (policy ACCEPT 9417K packets, 5055M bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
 287K   11M DROP       tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
   62  2668 DROP       tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:25
  686 31144 DROP       icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
    0     0 DROP       udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53

Chain FORWARD (policy ACCEPT 5106K packets, 5409M bytes)
 pkts bytes target     prot opt in     out     source               destination
 857K   61M ACCEPT     all  --  xx0    *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 10M packets, 11G bytes)
 pkts bytes target     prot opt in     out     source               destination

Interestingly enough, incoming UDP DNS request packets are not being dropped and my server is still answering them. TCP DNS requests are being dropped as you can see. My OS version is:

root@brohams ~# lsb_release -a
No LSB modules are available.
Distributor ID:    Ubuntu
Description:    Ubuntu 19.04
Release:    19.04
Codename:    disco

root@brohams ~# uname -romi
5.0.0-31-generic x86_64 x86_64 GNU/Linux

And my IPTABLES version is:

root@brohams ~# iptables -V
iptables v1.6.1

UPDATE

I noticed a lot of DNS queries reach my machine which are having a different destination IP address than my VPS.

root@brohams ~# tcpdump -s0 -vvvvni eth0 port 53 | grep -i ddosvictim
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
    172.217.40.8.36059 > x.x.179.4.53: [udp sum ok] 10363% [1au] A? victim.com. ar: . OPT UDPsize=4096 DO (57)
    74.125.190.150.65259 > x.x.179.4.53: [udp sum ok] 4809% [1au] SOA? victim.com. ar: . OPT UDPsize=4096 DO (57)
    141.101.70.60.59972 > x.x.179.4.53: [udp sum ok] 4272 [1au] A? victim.com. ar: . OPT UDPsize=1452 (46)
    76.96.47.215.6328 > x.x.179.4.53: [udp sum ok] 38615 [1au] ANY? www.victim.com. ar: . OPT UDPsize=4096 DO (50)
    64.135.1.20.28270 > x.x.179.4.53: [udp sum ok] 38218% [1au] AAAA? ns1.victim.com. ar: . OPT UDPsize=4096 DO (50)

As you can see, there are all sorts of requests in a large volume, thousands (output omitted for brevity). The fact that these packets even end up on my VPS is really mind bugling. Why should this happen?

This is when I query my own server, we can see my PREROUTING NAT is doing what it is told:

root@brohams ~# tcpdump -s0 -vvvvni eth0 port 53 | grep -i distro
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
    My.PC.83.162.36180 > My.VPS.183.141.53: [udp sum ok] 6595+ [1au] A? distrowatch.com. ar: . OPT UDPsize=4096 (56)
    My.VPS.183.141.36180 > 8.8.8.8.53: [udp sum ok] 6595+ [1au] A? distrowatch.com. ar: . OPT UDPsize=4096 (56)
    8.8.8.8.53 > My.VPS.183.141.36180: [udp sum ok] 6595 q: A? distrowatch.com. 1/0/1 distrowatch.com. [2h28m26s] A 82.103.136.226 ar: . OPT UDPsize=512 (60)
    My.VPS.183.141.53 > My.PC.83.162.36180: [udp sum ok] 6595 q: A? distrowatch.com. 1/0/1 distrowatch.com. [2h28m26s] A 82.103.136.226 ar: . OPT UDPsize=512 (60)

This machine has not been configured as any type of DNS server. It just acts as a recursive DNS server for VPN users that rarely connect to it, but it is crucial for them to have this function. Also it has only one interface (Eth0).

I could not find any bugs reported for this version of IPTABLES. Any idea why this type of traffic is still passing through and how to stop it?

P.S. I have tried re-adding the rule or move it around but it is still the same.

Thanks in advance

Improve this question
17
  • How do you know your server is actually receiving any UDP DNS packets? Do you see them in tcpdump?
    – Joseph Sible-Reinstate Monica
    Oct 13, 2019 at 17:35
  • 1
    I do see them in TCPDUMP and I'm also able to use dig to query my server and it replies DNS queries.
    – PoJam
    Oct 13, 2019 at 17:49
  • Is your DNS server using IPv6?
    – sebasth
    Oct 13, 2019 at 17:52
  • No IPv6. I am talking about A records.
    – PoJam
    Oct 13, 2019 at 18:10
  • 1
    it has IPv4 only sir. I run TCPDUMP and see my own queries.
    – PoJam
    Oct 13, 2019 at 18:19

1 Answer 1

Reset to default
1

So, the output of iptables -t nat -L showed:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       tcp  --  anywhere             anywhere             tcp dpt:domain to:8.8.8.8
DNAT       udp  --  anywhere             anywhere             udp dpt:domain to:8.8.8.8
DNAT       tcp  --  anywhere             anywhere             tcp dpt:domain to:8.8.8.8
DNAT       udp  --  anywhere             anywhere             udp dpt:domain to:8.8.8.8

which was really odd. I removed these rules by issuing iptables -t nat -D # and now the DNS queries are being blocked. Thanks everyone who tried to help. Really appreciate it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .