<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Ok, so here we go. I'm new to mailing lists, and have only used dnsdist for the most basic functions in the past.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I am now trying to use it as an anti-ddos measure in authoritative DNS for an ISP.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I can't seem to figure out how to make the dynmic rules apply. I was thinking I require some sort of add action or a pool definition somewhere.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I have intentionally set the trigger for "ANY" to 1 ever 100 seconds, so it will trigger and stay triggered.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
This is so I can verify the correct rule is applying.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
It would be very helpful to recieve some insight as to why the maintenance function/dynrules don't seem to apply?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks!</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
-Mike Willis</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
###########################</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Red Hat Enterprise Linux release 8.5 (Ootpa)<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Linux dnsdist01 4.18.0-348.12.2.el8_5.x86_64 #1 SMP Mon Jan 17 07:06:06 EST 2022 x86_64 x86_64 x86_64 GNU/Linux<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
4x cores</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
8GB memory</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
virtual machine</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2 nics (DMZ192/Public224)</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
###########################</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
-- DNSdist ns1
<div>-- Mike Willis 2-17-2022</div>
<div><br>
</div>
<div>----Set encrypton key for console-----------------------</div>
<div>setKey("redacted")</div>
<div>controlSocket('127.0.0.1:5199')</div>
<div><br>
</div>
<div>----- Local binds for DNS and ACLs --------------------<br>
</div>
<div>--ns1 public</div>
<div>setLocal("10.50.50.41:53")<br>
</div>
<div><br>
</div>
<div>-------------------------------------------------------<br>
</div>
<div>--setACL({'0.0.0.0/0', '::/0'})<br>
</div>
<div><br>
</div>
<div>-----------------------------------------------------<br>
</div>
<div>---Performance Tuning -------------------------------</div>
<div>--setRingBuffersSize(num[, numberOfShards])</div>
<div>setRingBuffersSize(500000,10)</div>
<div><br>
</div>
<div>----Dynamic blocking rules to mitigate abuse -----</div>
<div>--I'm not sure where to invoke, or apply these to a pool</div>
<div><br>
</div>
<div>local dbr = dynBlockRulesGroup()</div>
<div>dbr:setQueryRate(100, 10, "Exceeded query rate", 60)</div>
<div>dbr:setRCodeRate(DNSRCode.NXDOMAIN, 20, 10, "Exceeded NXD rate", 60)</div>
<div>dbr:setRCodeRate(DNSRCode.SERVFAIL, 20, 10, "Exceeded ServFail rate", 60)</div>
<div>dbr:setQTypeRate(DNSQType.ANY, 1, 100, "Exceeded ANY rate", 600)</div>
<div>dbr:setResponseByteRate(20000, 10, "Exceeded resp BW rate", 60)</div>
<div><br>
</div>
<div> function maintenance()</div>
<div> dbr:apply()</div>
<div> end</div>
<div><br>
</div>
<div>--NOTE: Rules are processed in order, and some rules stop processing of additional rules</div>
<div>--IE: Some rules should be the last to run for a given flow.</div>
<div><br>
</div>
<div><br>
</div>
<div>----------------- Logging ----------------------</div>
<div>---This should be turned off in prod ---</div>
<div>--LogAction([filename[, binary[, append[, buffered[, verboseOnly[, includeTimestamp]]]]]])</div>
<div>--Note will not work if buffering is true</div>
<div>addAction(AllRule(), LogAction("/var/log/dnsdist.log", false, true, false, false, true))</div>
<div>-------------------------------------------------</div>
<div><br>
</div>
<div>----- Pool Availability rules and failover ------</div>
<div>--Send traffic to ns1 if it is up</div>
<div>addAction(PoolAvailableRule("ns1"), PoolAction("ns1"))</div>
<div>--Send traffic to ns2 if ns1 is down</div>
<div>addAction(AllRule(), PoolAction("ns2"))</div>
<div>------------------------------------------------</div>
<div><br>
</div>
<div><br>
</div>
<div>----------- Load balanced servers and pool definitions ---------------</div>
<div>--ns1</div>
<div>--intentionally broken for testing failover</div>
<div><br>
</div>
<div>newServer({address="127.0.0.2", source="ens224", pool="ns1"})</div>
<div><br>
</div>
<div>--ns2 will be across a wan</div>
<div>newServer({address="9.9.9.9", source="ens224", pool="ns2"})</div>
<div><br>
</div>
<div><br>
</div>
<span>---------------------------------------------------------------------</span> </div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
############################################</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
dig @10.50.50.41 -tany dnsdist.org
<div><br>
</div>
<div>; <<>> DiG 9.11.26-RedHat-9.11.26-6.el8 <<>> @10.50.50.41 -tany dnsdist.org</div>
<div>; (1 server found)</div>
<div>;; global options: +cmd</div>
<div>;; Got answer:</div>
<div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10952</div>
<div>;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1</div>
<div><br>
</div>
<div>;; OPT PSEUDOSECTION:</div>
<div>; EDNS: version: 0, flags:; udp: 512</div>
<div>;; QUESTION SECTION:</div>
<div>;dnsdist.org. IN ANY</div>
<div><br>
</div>
<div>;; ANSWER SECTION:</div>
<div>dnsdist.org. 43193 IN NS pdns-public-ns1.powerdns.com.</div>
<div>dnsdist.org. 3593 IN SOA pdns-public-ns1.powerdns.com. pieter\.lexis.powerdns.com. 2020080301 10800 3600 604800 10800</div>
<div>dnsdist.org. 43193 IN NS pdns-public-ns2.powerdns.com.</div>
<div>dnsdist.org. 43193 IN A 188.166.104.92</div>
<div>dnsdist.org. 43193 IN AAAA 2a03:b0c0:2:d0::4ab:8001</div>
<div><br>
</div>
<div>;; Query time: 48 msec</div>
<div>;; SERVER: 10.50.50.41#53(10.50.50.41)</div>
<div>;; WHEN: Wed Feb 23 10:38:03 EST 2022</div>
<div>;; MSG SIZE rcvd: 205</div>
<div><br>
</div>
<div>[root@dnsdist01 dnsdist]# dnsdist -c</div>
<div>> showDynBlocks()</div>
<div>What Seconds Blocks Warning Action Reason</div>
<span>></span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
</body>
</html>