1

I newly configured bind9 on my ubuntu server and set allow-query to { any; } as I want my DNS server to be accessible for anywhere. However, I am now facing DOS attack using peacecorps.gov domain with different IP address. Getting DNS request every seconds. How to mitigate this issue? Is there a way to block DNS lookup for particular website?

My bind9 option configuration

options {
        directory "/var/cache/bind";
    
        forwarders {
                8.8.8.8;
                8.8.4.4;
        };

        dnssec-validation auto;

        listen-on { any; };
        listen-on-v6 { any; };
        allow-query { any; };
        allow-recursion { any; };

        version "Forbidden";
};

DNS Logs DNS Log

Kalaivanan
  • 111
  • 3
  • 1
    The log shows only about 10 queries per second. That isn't nearly enough to qualify as a DoS attack. If you want to provide DNS resolver service to the world your server needs to be able to handle a much bigger load than that. You'll also want to disable query logging. By the way, please don't include textual information like log excerpts as graphics. – Tilman Schmidt Mar 07 '21 at 14:24

1 Answers1

3

I newly configured bind9 on my ubuntu server and set allow-query to { any; } as I want my DNS server to be accessible for anywhere.

You get exactly what you've configured.
A DNS server that can be used by anybody. Or rather, abused by anybody and it is being used for abuse right now.

See for example this alert regarding incorrectly configured DNS servers such as yours:

The only public queries that your DNS server should allow and answer, are for the domain names it is authoritative for. (in other words: for your own domain).

If your bind server is to be caching resolver, it should only offer that service to your own servers/subnet, not the whole internet.

Set up an access control list and only allow authorised / trusted clients to use your DNS server and this problem should stop

acl myclients {
        192.0.2.0/24;
        localhost;
};


options {
        directory "/var/cache/bind";
    
        forwarders {
                8.8.8.8;
                8.8.4.4;
        };

        dnssec-validation auto;

        listen-on { any; };
        listen-on-v6 { any; };
        allow-query { myclients; };
        allow-recursion { myclients; };

        version "Forbidden";
};
Bob
  • 5,805
  • 7
  • 25