lots of dns requests from China, should I worry?

Question

I have turned on dns query logs, and when running "tail -f /var/log/syslog" I see that I get hundreds of identical requests from a single ip address:

Apr  7 12:36:13 server17 named[26294]: client 121.12.173.191#10856: query: mydomain.de IN ANY +
Apr  7 12:36:13 server17 named[26294]: client 121.12.173.191#44334: query: mydomain.de IN ANY +
Apr  7 12:36:13 server17 named[26294]: client 121.12.173.191#15268: query: mydomain.de IN ANY +
Apr  7 12:36:13 server17 named[26294]: client 121.12.173.191#59597: query: mydomain.de IN ANY +

The frequency is about 5 - 10 requests per second, going on for about a minute. After that the same effect repeats from a different IP address. I have now logged about 10000 requests from about 25 ip addresses within just a couple of hours, all of them come from China according to "whois [ipaddr]".

What is going on here? Is my name server under attack? Can I do something about this?

Solution 1

What is going on here? Is my name server under attack? Can I do something about this?

What is going on here?

It's impossible to tell from the munged log entries. Here are just a few possibilities:

• Your service is popular in China. Congrats
• Someone misconfigured a script that uses your API
• Someone's running code that gathers DNS information for billions of domains. Yours is one of them
• A spammer is spoofing your domain and a mail server is checking DNS records as part of an antispam solution
• You're under attack

Is my name server under attack?

At 5-10 DNS requests/sec from a handful of IPs? Doubtful. Most DNS attacks I know of use specially crafted requests to mess with your server's internal functionality or overwhelm its resources. Generally, if you have to ask, you're not under attack.

Can I do something about this?

Sure, you can block the offending IPs in your firewall or install the aforementioend Fail2Ban tool.

But should you?

Remember, your DNS server's entire job is to answer requests. You noticed this after you turned on query logging and watched the output. Are you seeing crazy CPU usage? Network IO? Are other, known-legitimate requests going unserved due to resource contention?

If not, why would you block them? Let the protocols work the way they're designed. If you want cleaner logs, turn off query logging until you need to diagnose a problem.

Solution 2

Someone is abusing your DNS server to perform an amplification attack against the IP address 121.12.173.191, which is being spoofed by the attackers.

Since DNS mostly uses UDP which is a connectionless protocol it is trivial to spoof the source address of a query and have the (larger) response be sent back to the real owner of that spoofed address.

The use of ANY queries to achieve amplification is well known in DNS circles, but only relatively recently seen misused by hackers.

It it likely that if you monitored the IP TTLs of the inbound packets that they will be inconsistent - indicating that the spoofed packets are taking many different paths to reach you even though they all appear to be from the same place.

You may well only be seeing 5-10 packets per second, but the attackers will be using many other hosts to saturate the target address.

Solution 3

While Fail2ban would work (I recommend it for many purposes) if you're seeing the same IP over and over, unchanging, there's no reason not to just drop it altogether.

Block it at your firewall or use IPTables.

iptables -A INPUT -s 121.12.173.191 -j DROP

That should get rid of the requests.

If you see other sources hitting your server, then you can either use IPTables to block requests from anything that isn't from your network or use fail2ban to use temporary blocking.

Fail2ban uses IPTables anyway to block requests, so permanently adding it isn't a stretch. You'll also want to look up on your distro how to make the change permanent (usually your network scripts at startup). If you're behind a firewall, I'd highly recommend blocking the IP there first.

Regardless how you do it make sure you document that you did this so you're (or your replacement is) not stuck figuring out a few months from now why it was done.

Solution 4

I don't know if this is caused by automated scanning, spam distributors or other things. But what you can do is installing fail2ban and configure it for blocking too many DNS requests per defined time interval.

Hopefully, this link will help you: http://www.debian-administration.org/article/Blocking_a_DNS_DDOS_using_the_fail2ban_package

Solution 5

5-10 reqs per second are not that huge amount and normally are not a symptom of an attack (except if they are making malformed queries or trying to use some exploit to gain system access torough some BIND vulnerability... Maybe someone is just playing with a script or posted some example code using your DNS server as a reference on some chineese forum or it's just a bot trying to make recursive queries about some domains (you should check tat on BIND conf file in the logging section http://www.zytrax.com/books/dns/ch7/logging.html just by inspecting what kind of queries they are doing) Given the low amount of requests (i hope your DNS infrastucture can survive with that!) you have 2 possibilities:

1 - Block the chineese IP addresses all together (check http://www.find-ip-address.org/ip-country/ )

2 - Limit the number of connections to 3 per second per IP using iptables

iptables -A INPUT -s ipaddress -p udp --dport 53 -m limit --limit 3/s -j ACCEPT
iptables -A INPUT -s ipaddress -p udp --dport 53 -j DROP

Note that limiting the concurrent connections, may cause some issues if you apply this for any IP address, as legitimate queries of legitimate clients will timeout, slowing down the browsing speed of any client/server using your DNS...

View more solutions

Comments

[MrGigu]

Munged - that's a new word to me; I must add that to my vocabulary!

[nn4l]

Thanks, since the additional server load is negligible I think it is not a real problem and I should not fix it.

[JamesCW]

In addition, if your DNS server is meant only for internal requests, you could consider moving it to an IP that would not be reachable from outside of your network: 10.0.0.0 – 10.255.255.255, 172.16.0.0 – 172.31.255.255, or 192.168.0.0 – 192.168.255.255. We default to using private IP's for our servers unless they are specifically serving people not on our network.

[Dan]

This is the correct answer. In addition, see redbarn.org/dns/ratelimits for information on limiting responses to this kind of attack.

[Alnitak]

@Dan yes, those patches weren't available when I wrote this answer, but I can confirm that they are very effective.