<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Hello,</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Thanks for the reply Remi. I think adding that to the dynamic rule would be a great feature for everyone having trouble with bot poisoning the cache :)</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
You mentioned that "adding the offending IP to a NetmaskGroup so that it can be used from existing rules" - can this be done now? If so, how can I do this?</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
The "setRCodeRatio" is good, but I would not rather block customers legit queries because he's infected. </div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
If there is no better alternative, how can I go about capturing the offending IPs whose generating SERVFAILs to a list using the setRCodeRatio feature? So that I can use a Lua script to auto add those IP's to an addiction function towards a pool. doable?</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
With this approach, even a false positive would not be disruptive but rather in a controlled abuse pool.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Thanks</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
AH</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> dnsdist <dnsdist-bounces@mailman.powerdns.com> on behalf of Remi Gacogne via dnsdist <dnsdist@mailman.powerdns.com><br>
<b>Sent:</b> Monday, December 13, 2021 8:43 AM<br>
<b>To:</b> dnsdist@mailman.powerdns.com <dnsdist@mailman.powerdns.com><br>
<b>Subject:</b> Re: [dnsdist] Dynamic Rule for abusive SERVFAIL queries from bots</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Hi,<br>
<br>
On 11/12/2021 08:44, me aharen via dnsdist wrote:<br>
> I am running dnsdist 1.6.1 and I am unable to figure out the safest <br>
> method of handling large amounts of SERVFAIL queries to random domains.<br>
> <br>
> Right now I manually check SERVFAIL responses via 'topResponses(50, <br>
> dnsdist.SERVFAIL)', and pick a repeating domain from the list and then <br>
> apply a LogAction to identify the offending IPs.<br>
> <br>
> After some log collection, I run through sort/unique and pick the IPs <br>
> that are cache poisoning with SERVFAILs and simply apply rule <br>
> 'addAction(<IPs>, PoolAction("abuse"))'.<br>
> <br>
> It a very manual cumbersome approcah. The best method I found was to use <br>
> dynBlockRulesGroup() as follows:<br>
> <br>
> local dbr = dynBlockRulesGroup()<br>
> <br>
> dbr:setRCodeRate(DNSRCode.SERVFAIL, 20, 10, "Exceeded ServFail<br>
> rate", 60)<br>
> <br>
> <br>
> function maintenance()<br>
> <br>
> dbr:apply()<br>
> <br>
> end<br>
> <br>
> This works but this is a bit disruptive. I would like is to send the <br>
> offending IP's to an abuse pool I have already set up.<br>
> <br>
> Any Idea how can use the dynBlock function to send the IP's to abuse <br>
> Pool? or is there a better way to handle this?<br>
<br>
I'm afraid dnsdist currently doesn't support routing to a pool as a <br>
target of a dynamic block, that might be an interesting feature request. <br>
Or perhaps adding the offending IP to a NetmaskGroup so that it can be <br>
used from existing rules. Or both :)<br>
<br>
One way to reduce the risk of false positives might be to rely on the <br>
ratio of ServFail answers over all the answers returned to a given <br>
client, instead of just using the raw numbers of ServFail answers, which <br>
can be done with DynBlockRulesGroup:setRCodeRatio [1]. That way you can <br>
block a client if it received more than N servfails AND more than Y % <br>
percent of all responses for that client were servfails.<br>
<br>
[1]: <br>
<a href="https://dnsdist.org/reference/config.html?highlight=setrcode#DynBlockRulesGroup:setRCodeRatio">https://dnsdist.org/reference/config.html?highlight=setrcode#DynBlockRulesGroup:setRCodeRatio</a><br>
<br>
Hope that helps,<br>
-- <br>
Remi Gacogne<br>
PowerDNS.COM BV - <a href="https://www.powerdns.com/">https://www.powerdns.com/</a><br>
</div>
</span></font></div>
</body>
</html>