On 12 October 2017 at 23:58, Pedro Ribeiro ct7abp@gmail.com wrote:
Hello everyone,
I'm creating a gateway here, to be used to static and dynamic VPNs to Portuguese HAMs trying to access the 44net.
I've noticed that after I've leaven the router a few days with the DNS relay open (big mistake!), I was receiving a stream of dummy querys about a hundred per second.
I was able to block it in our (Lisbon Polytechnics) firewall (before ipip de-encapsulation) with the next iptables rule:
# iptables -t raw -A PREROUTING -i eth0 -p ipencap -d 193.137.237.9 -m length --length 87 -m u32 --u32 "42 = 0x0035002f" -j DROP
Now I've disabled the gateway at the AMPR portal and I'll wait for them to calm down.
I don't know if more tunnels are affected by this so I'm sharing the information.
I consider it an automatic configuration check for DNS servers. If I accidentally misconfigure a DNS server than I get a notification in the form of a huge increase in bandwidth within a few hours!
Your firewall rule will only block that specific query, and the next attempt using a different hostname will start everything all over again.
Recursive Resolvers should be limited to only serving specific clients (44/8?), but if you do want an open resolver then you need to actively "manage it". At a bare minimum you should disable ANY queries, and I would suggest also investigating Response Rate Limiting.
Doing it "properly" like Google/OpenDNS/etc is beyond a few configuration options in an off-the-shelf resolver, hence it being easier to just restrict the allowed hosts.
Thanks, Mike, M6XCV