On Mon, 18 Mar 2013 12:33:03 -0500, Gerald Waugh <gwa...@frontstreetnetworks.com> wrote: > On 03/18/2013 06:00 AM, Will Nordmeyer wrote: >> >> Last night (actually over the past few days), my server has been >> hammered with DNS requests (to the tune of about 5 Mb/sec bandwidth, 6 >> IPs, 10-20 connections, thousands of requests)... Is there a way for >> bfd/apf or another tool to monitor for this and add the offending >> servers to either deny_hosts.rules or iptables? >> >> > /sbin/iptables -A INPUT -i eth0 -p tcp -m tcp --dport 53 -m state > --state NEW -m recent --set --name DNS --rsource > > /sbin/iptables -A INPUT -i eth0 -p tcp -m tcp --dport 53 -m state > --state NEW -m recent --update --seconds 60 --hitcount 10 --rttl --name > DNS --rsource -j LOG --log-prefix "Block DNS port 53 Attack " > > /sbin/iptables -A INPUT -i eth0 -p tcp -m tcp --dport 53 -m state > --state NEW -m recent --update --seconds 60 --hitcount 10 --rttl --name > DNS --rsource -j DROP
Gerald, Just to confirm - the first line sets up a counter, the second line logs a DNS attack after 10 hits in 60 seconds and the 3rd one drops further DNS queries from that annoying site? _______________________________________________ Blueonyx mailing list Blueonyx@mail.blueonyx.it http://mail.blueonyx.it/mailman/listinfo/blueonyx