If you run a DNS server on the Internet with a default configuration many people\/robots will take advantage of you. The same is true for Mail, but that is another article. Needless to say if you are running a service on the Internet, the naughty goblins will find you. To thwart these dirty criminals all that’s necessary is to configure your named.conf properly. However, since these robotos are being naughty there is a high degree of certainty they are infected endpoints, and as such I really don’t want them coming anywhere near me or my machines. After all for humanity sake we don’t want to be infected by the deadly plague ! This article is short and sweet, here is how to protect your DNS server & your server in one article using named.conf & ufw (iptables).<\/p>\n
<\/p>\n
Now a days named.conf is really just a file that inherits 3 other files, named.conf.local, named.conf.options, and named.conf.default-zones. The one we are going to fix is named.conf.options. The configuration below should only be applied in a scenario where you want to run an authorative nameserver, and a caching name server, but the key is you only want to allow people to query the cache that ‘you know personally or are you’ vs. allowing the entire internet, because then bad things happen. If this is not the setup you are going for, don’t do this \ud83d\ude42 But if it is follow along.<\/p>\n
Add the following section with the proper IP’s to the top fo the file<\/p>\n
acl \"trusted\" {\r\n192.241.206.98;\r\nlocalhost;\r\nlocalnets;\r\n};<\/pre>\nNote you can also add a CIDR for a subnet\u00a0like 192.168.0.0\/16<\/p>\n
After that’s done under the options {} section… make it look like this<\/p>\n
allow-query { any; };\r\n allow-recursion { trusted; };\r\n allow-query-cache { trusted; };\r\n allow-transfer { 202.157.182.142; };<\/pre>\nNote, allow transfer is necessary if you have a secondary nameserver that needs to receive updates. Now restart bind9<\/p>\n
tuxninja@tlprod1:\/etc\/bind$ sudo service bind9 restart<\/pre>\nOk now all querying<\/strong> including\u00a0behavior from non-trusted people will not be allowed. If it is working check your \/var\/log\/syslog and you will see some denies like this<\/p>\nNov 11 16:00:31 tlprod1 named[952]: client 192.163.221.224#80 (hehehey.ru): query (cache) 'hehehey.ru\/ANY\/IN' denied\r\nNov 11 16:00:31 tlprod1 named[952]: client 192.163.221.224#80 (hehehey.ru): query (cache) 'hehehey.ru\/ANY\/IN' denied\r\nNov 11 16:00:31 tlprod1 named[952]: client 104.37.29.110#4761 (hehehey.ru): query (cache) 'hehehey.ru\/ANY\/IN' denied<\/pre>\nNow the above is from my actual log file. I was quite annoyed that clients are basically abusing the hell out of hehehey.ru… so I decided I don’t want to talk to those people at all<\/strong>. To those people I should be a blackhole. To do this I used UFW which is short for uncomplicated firewall, which essentially makes dealing with Iptables much much nicer. It’s only my 2nd time using UFW, but I’ve been using Iptables for well over a decade. Anyway, here is my simple setup with UFW that I came up with.<\/p>\ntuxninja@tlprod1:\/etc\/bind$ sudo ufw default deny incoming\r\nDefault incoming policy changed to 'deny'\r\n(be sure to update your rules accordingly)\r\n\r\ntuxninja@tlprod1:\/etc\/bind$ sudo ufw default allow outgoing\r\nDefault outgoing policy changed to 'allow'\r\n(be sure to update your rules accordingly)\r\n\r\ntuxninja@tlprod1:\/etc\/bind$ sudo ufw allow ssh\r\nRules updated\r\nRules updated (v6)\r\n\r\ntuxninja@tlprod1:\/etc\/bind$ sudo ufw allow 80\r\nRules updated\r\nRules updated (v6)<\/pre>\nSo we are configuring the default policy to deny all incoming traffic, allow outgoing, and then allow SSH & Apache\/Web traffic basically. Next I created a script called block.sh to add ufw deny rules for bad actors I parsed out of my log, here’s what block.sh looks like<\/p>\n
# cat block.sh \r\n#!\/bin\/bash\r\n\r\nwhile read line; do\r\n\tufw deny from $line\r\ndone<\/pre>\nDon’t forget to chmod +x your shell script. Then I did this… blocking all bad actors…<\/p>\n
root@tlprod1:~# cat \/var\/log\/syslog | grep hehehey.ru | grep -v repeated | awk -F ' ' '{print $7}' | cut -d '#' -f 1 | .\/block.sh<\/pre>\nNote, use sudo if you don’t run this as root. This will go through my log and find all these bad requests, and block the requestor. It’s quite aggresive, so be careful, make sure you thoroughly limit your parsing with grep to only block things you really don’t want talking to your server, because this blocks ALL traffic from this requestor to your service, not just DNS.<\/p>\n
Once that is complete you need to finally permit good DNS requests by running<\/p>\n
ufw allow 53<\/pre>\nAnd then finally enable your firewall<\/p>\n
ufw enable<\/pre>\nIf you are successful you should see entries in your log that look like this<\/p>\n
Nov 11 15:10:35 tlprod1 kernel: [1652178.544292] [UFW BLOCK] IN=eth0 OUT= MAC=04:01:63:57:8a:01:3c:8a:b0:0d:3f:f0:08:00 SRC=65.60.18.103 DST=192.241.206.198 LEN=72 TOS=0x00 PREC=0x00 TTL=247 ID=31303 PROTO=UDP SPT=20225 DPT=53 LEN=52<\/pre>\nYou can also view all your firewall rules by running<\/p>\n
sudo ufw status numbered<\/pre>\nHappy Blocking !<\/p>\n
<\/h2>\n
<\/p>\n
<\/p>\n