[148557] in North American Network Operators' Group
Re: DNS Attacks
daemon@ATHENA.MIT.EDU (Christopher Morrow)
Wed Jan 18 11:43:35 2012
In-Reply-To: <0C0D0264-E925-4CE0-8F6A-5BE4DE70F543@cs.columbia.edu>
Date: Wed, 18 Jan 2012 11:42:42 -0500
From: Christopher Morrow <morrowc.lists@gmail.com>
To: Steven Bellovin <smb@cs.columbia.edu>
Cc: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Wed, Jan 18, 2012 at 11:34 AM, Steven Bellovin <smb@cs.columbia.edu> wro=
te:
>
> On Jan 18, 2012, at 10:41 30AM, Christopher Morrow wrote:
>
>> On Wed, Jan 18, 2012 at 10:05 AM, Nick Hilliard <nick@foobar.org> wrote:
>>> On 18/01/2012 14:18, Leigh Porter wrote:
>>>> Yeah like I say, it wasn't my idea to put DNS behind firewalls. As lon=
g
>>>> as it is not *my* firewalls I really don't care what they do ;-)
>>>
>>> As you're posting here, it looks like it's become your problem. :-D
>>>
>>> Seriously, though, there is no value to maintaining state for DNS queri=
es.
>>> =A0You would be much better off to put your firewall production interfa=
ces on
>>> a routed port on a hardware router so that you can implement ASIC packe=
t
>>> filtering. =A0This will operate at wire speed without dumping you into =
the
>>> colloquial poo every time someone decides to take out your critical
>>> infrastructure.
>>
>> I get the feeling that leigh had implemented this against his own
>> advice for a client... that he's onboard with 'putting a firewall in
>> front of a dns server is dumb' meme...
>
> In principle, this is certainly correct (and I've often said the same thi=
ng
> about web servers); in practice, though, a lot depends on the specs. =A0F=
or
> example: can the firewall discard useless requests more quickly? =A0Does =
it do
> a better job of discarding malformed packets? =A0Is the vendor better abo=
ut
> supplying patches to new vulnerabilities? =A0Can it do a better job filte=
ring
> on source IP address? =A0Does it do load-balancing? =A0Are there other se=
rvices
> on the same server IP address that do require stateful filtering?
yup... I think roland and nick (he can correct me, roland I KNOW is
saying this) are basically saying:
permit tcp any any eq 80
permit tcp any any eq 443
deny ip any any
is far, far better than state management in a firewall. Anything more
complex and your firewall fails long before the 7206's
interface/filter will :( Some folks would say you'd be better off
doing some LB/filtering-in-software behind said router interface
filter, I can't argue with that.
> As I said, most of the time a dedicated DNS appliance doesn't benefit fro=
m
> firewall protection. =A0Occasionally, though, it might.
I suspect the cases where it MAY benefit are the 'lower packet rate,
ping-o-death-type' attacks only though. Essentially 'use a proxy to
remove unknown cruft' as a frontend to your more complex dns/web
answering system, eh?
under load though, high pps rate attacks/instances (victoria secret
fashion-show sorts of things) your firewall/proxy is likely to die
before the backend does ;(
-chris
>
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0--Steve Bellovin, https://www.cs.columbia.=
edu/~smb
>
>
>
>
>
