Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 9 replies
  • Subscribers 2 subscribers
  • Views 6633 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DNS attacks

loneleever
Hey BarryG,

thanks for your answer.

Spread of the whole day, I have several DNS "attacks" on two of my public ip addresses. currently we provide two public dns server behind the dmz, which are only responsable for a few domains. For that, there is a DNAT rule:

ANY - DNS (53) - public ip (address)
Auto firewall: no
Initial Log: no

Additionally, I have defined a new packet filter for that:
Internet IPv4 - DNS (53) - internal host

However, normally all incoming requests on port 53 through the correct public ip address, should be processed and match with the rule right?

Why then I see this entries in the log files as a default drop? I'm a little bit confused... [:)]

Default DROP  UDP     111.111.111.118  :  58108
→  123.123.123.5  :  53

Over the day the firewall drops 200.000 between 800.000 requests on port 53, requested to the public dns servers.

I´m wondering, why the IPS does not intervene and detect the requests. Some days the system detects 2-3 "DNS amplification attempts". The requests coming from various IP addresses. There is no visible pattern, they are really random. Otherwise i would give the contry blocking-feature a try. The requests take sometimes up to 1-2 hours.... :-(

Any idea?

Thanks!


This thread was automatically locked due to age.
Parents
  • 0
    Hi, please post the related lines from the FULL firewall log (not the live log).

    Barry
  • 0 in reply to BarryG
    05:24:12 Default DROP  UDP 107.14.126.64:21086 → 123.123.123.5:53 len=67 ttl=243 tos=0x00 srcmac=1a:1b:1c:1d:1e:1 dstmac=2a:2b:2c:2d:2e:0
    05:24:12 Default DROP  UDP 23.224.216.17:12689 → 123.123.123.5:53 len=63 ttl=241 tos=0x00 srcmac=1a:1b:1c:1d:1e:1 dstmac=2a:2b:2c:2d:2e:0
    05:24:13 Default DROP  UDP 86.154.67.221:61201 → 123.123.123.5:53 len=65 ttl=240 tos=0x00 srcmac=1a:1b:1c:1d:1e:1 dstmac=2a:2b:2c:2d:2e:0
Reply
  • 0 in reply to BarryG
    05:24:12 Default DROP  UDP 107.14.126.64:21086 → 123.123.123.5:53 len=67 ttl=243 tos=0x00 srcmac=1a:1b:1c:1d:1e:1 dstmac=2a:2b:2c:2d:2e:0
    05:24:12 Default DROP  UDP 23.224.216.17:12689 → 123.123.123.5:53 len=63 ttl=241 tos=0x00 srcmac=1a:1b:1c:1d:1e:1 dstmac=2a:2b:2c:2d:2e:0
    05:24:13 Default DROP  UDP 86.154.67.221:61201 → 123.123.123.5:53 len=65 ttl=240 tos=0x00 srcmac=1a:1b:1c:1d:1e:1 dstmac=2a:2b:2c:2d:2e:0
Children
No Data