[161831] in North American Network Operators' Group
Re: Open Resolver Problems
daemon@ATHENA.MIT.EDU (Owen DeLong)
Wed Mar 27 11:57:10 2013
From: Owen DeLong <owen@delong.com>
In-Reply-To: <CAP-guGWQjOVEJ4OCEn3sJuHLwq-hwg=g-7WdzAuhj77Uj3i4Cg@mail.gmail.com>
Date: Wed, 27 Mar 2013 08:54:27 -0700
To: William Herrin <bill@herrin.us>
Cc: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
It's been available in linux for a long time, just not in BIND=85
Here is a working ip6tales example:
-A RH-Firewall-1-INPUT -s 2620:0:930::/48 -m state --state NEW -m udp -p =
udp --dport 53 -j ACCEPT
-A RH-Firewall-1-INPUT -s 2001:470:1f00:3142::/64 -m state --state NEW =
-m udp -p udp --dport 53 -j ACCEPT
-A RH-Firewall-1-INPUT -s 2620:0:930::/48 -m state --state NEW -m tcp -p =
tcp --dport 53 -j ACCEPT
-A RH-Firewall-1-INPUT -s 2001:470:1f00:3142::/64 -m state --state NEW =
-m tcp -p tcp --dport 53 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 53 -m =
limit --limit 30/minute --limit-burst 90 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 53 -m =
limit --limit 30/minute --limit-burst 90 -j ACCEPT
YMMV and you may wish to provide tighter limits (less than 30 QPM or a =
burst of <90).
Owen
On Mar 27, 2013, at 6:47 AM, William Herrin <bill@herrin.us> wrote:
> On Tue, Mar 26, 2013 at 10:07 PM, Tom Paseka <tom@cloudflare.com> =
wrote:
>> Authoritative DNS servers need to implement rate limiting. (a client
>> shouldn't query you twice for the same thing within its TTL).
>=20
> Right now that's a complaint for the mainstream software authors, not
> for the system operators. When the version of Bind in Debian Stable
> implements this feature, I'll surely turn it on.
>=20
> Regards,
> Bill Herrin
>=20
>=20
> --=20
> William D. Herrin ................ herrin@dirtside.com bill@herrin.us
> 3005 Crane Dr. ...................... Web: <http://bill.herrin.us/>
> Falls Church, VA 22042-3004
