Public Facing Recursive DNS Servers - iptables rules

Posted by David Schwartz on Server Fault See other posts from Server Fault or by David Schwartz
Published on 2012-08-17T23:10:07Z Indexed on 2012/10/28 17:03 UTC
Read the original article Hit count: 288

Filed under:
|

We run public-facing recursive DNS servers on Linux machines. We've been used for DNS amplification attacks. Are there any recommended iptables rules that would help mitigate these attacks?

The obvious solution is just to limit outbound DNS packets to a certain traffic level. But I was hoping to find something a little bit more clever so that an attack just blocks off traffic to the victim IP address.

I've searched for advice and suggestions, but they all seem to be "don't run public-facing recursive name servers". Unfortunately, we are backed into a situation where things that are not easy to change will break if we don't do so, and this is due to decisions made more than a decade ago before these attacks were an issue.

© Server Fault or respective owner

Related posts about dns

Related posts about ddos