<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello Remi,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thank you for the quick response!</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I had really just set the "ANY" trigger really low so that it would invoke, and I could verify that the rules were applying.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">If I update it with the dbr rule you provided, it does indeed create a block after the first request. (yay).</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">I changed the to rule to:</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">dbr:setQTypeRate(DNSQType.ANY, 1, 10, "Exceeded ANY rate", 600)<br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
After testing It looks like the entire 10 seconds needed to elapse before the rule is evaluated.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I was not expecting this logic, and that was tripping me up. I was thinking that the rules were not applying at all.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">I definitely want to enable sensible rules for an auth server with 2500 zones and an average of 14k'ish QPS.</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">Thank you very much for your time!</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">-Mike Willis </span><br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> dnsdist <dnsdist-bounces@mailman.powerdns.com> on behalf of Remi Gacogne via dnsdist <dnsdist@mailman.powerdns.com><br>
<b>Sent:</b> Wednesday, February 23, 2022 10:59 AM<br>
<b>To:</b> dnsdist@mailman.powerdns.com <dnsdist@mailman.powerdns.com><br>
<b>Subject:</b> Re: [dnsdist] How to apply dynamic rules with pools?</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Hi Mike,<br>
<br>
On 23/02/2022 16:49, Willis, Michael via dnsdist wrote:<br>
> I have intentionally set the trigger for "ANY" to 1 ever 100 seconds, so <br>
> it will trigger and stay triggered.<br>
> This is so I can verify the correct rule is applying.<br>
<br>
> dbr:setQTypeRate(DNSQType.ANY, 1, 100, "Exceeded ANY rate", 600)<br>
<br>
This rule is saying "block, for 600 seconds, clients that have been <br>
sending more than one ANY query per second over the last 100 seconds", <br>
so one query is not going to be enough to trigger the block.<br>
<br>
You could try this one instead:<br>
<br>
dbr:setQTypeRate(DNSQType.ANY, 0, 1, "Exceeded ANY rate", 600)<br>
<br>
This will block any client that has been sending more than 0 ANY query <br>
per second over the last second. In my test this results in getting <br>
blocked right away after sending your first ANY query. I'm not sure I <br>
would recommend such a drastic rule, but that's a different matter :)<br>
<br>
Hope that helps,<br>
-- <br>
Remi Gacogne<br>
PowerDNS.COM BV - <a href="https://www.powerdns.com/">https://www.powerdns.com/</a><br>
</div>
</span></font></div>
</body>
</html>