<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 03/18/2013 02:10 PM, Will Nordmeyer,
WnA Consulting Services wrote:<br>
</div>
<blockquote cite="mid:64572788cf4f850af77a5056336ceb3e@willspc.net"
type="cite">
<pre wrap="">On Mon, 18 Mar 2013 12:33:03 -0500, Gerald Waugh
<a class="moz-txt-link-rfc2396E" href="mailto:gwaugh@frontstreetnetworks.com"><gwaugh@frontstreetnetworks.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On 03/18/2013 06:00 AM, Will Nordmeyer wrote:
</pre>
<blockquote type="cite">
<pre wrap="">
Last night (actually over the past few days), my server has been
hammered with DNS requests (to the tune of about 5 Mb/sec bandwidth, 6
IPs, 10-20 connections, thousands of requests)... Is there a way for
bfd/apf or another tool to monitor for this and add the offending
servers to either deny_hosts.rules or iptables?
</pre>
</blockquote>
<pre wrap="">/sbin/iptables -A INPUT -i eth0 -p tcp -m tcp --dport 53 -m state
--state NEW -m recent --set --name DNS --rsource
/sbin/iptables -A INPUT -i eth0 -p tcp -m tcp --dport 53 -m state
--state NEW -m recent --update --seconds 60 --hitcount 10 --rttl --name
DNS --rsource -j LOG --log-prefix "Block DNS port 53 Attack "
/sbin/iptables -A INPUT -i eth0 -p tcp -m tcp --dport 53 -m state
--state NEW -m recent --update --seconds 60 --hitcount 10 --rttl --name
DNS --rsource -j DROP
</pre>
</blockquote>
<pre wrap="">
Gerald,
Just to confirm - the first line sets up a counter, the second line
logs a DNS attack after 10 hits in 60 seconds and the 3rd one drops
further DNS queries from that annoying site?
</pre>
</blockquote>
Correct<br>
You can adjust times and hitcount, I use this for all the open ports<br>
changing dport as necessary<br>
<br>
You will see many entries in /var/log/iptables, but only the
hitcount number of entries in the regular log files.<br>
Need to setup rsyslog to log to iptables<br>
<br>
/etc/rsyslog.conf added the rule in bold<br>
do a service rsyslog restart<br>
<br>
#### RULES ####<br>
<br>
# Log all kernel messages to the console.<br>
# Logging much else clutters up the screen.<br>
#kern.* /dev/console<br>
<br>
<b>kern.warning
/var/log/iptables</b><br>
<br>
<div class="moz-signature">-- <br>
Gerald</div>
</body>
</html>