Post #2175108
2024-09-16 19:29 UTC
Had to reset my DNS server because some S-head was using it to mask the source of their DDoS attack.
Anyone know of a bind9 switch that reduces the number of requests handled to no more than 200/hr?
The service is on a Digital Ocean droplet and serves 'example.com' so that the test services can perform unit testing and build example material for Internet Drafts.
Replies (2)
-
@markd@hachyderm.io 2024-09-16 21:47
@hallam@infosec.exchange I don't think anything in bind9 rate-limits below 1 qps as most of the RRL internals are stored as integer rates per second. If you want to go down as low as 0.05 qps, that might require something custom as my suspicion is that most name servers which implement RRL most likely mimic bind. Obviously you've thought about the false positive risks, so if you do something at these rates it'll be interesting to hear how it works out.
-
@AGMS00@ruby.social 2024-09-17 02:44
Not off-hand. My quick fix would be to use Fail2Ban to block by firewall IP addresses sending too many requests. Though would the DNS log volume be too much for Python based F2B to handle?