Tier-1 Security Measures
Protecting Against Attacks
Tier-1 operators may occasionally find themselves being used as a point of attack. The information below has been developed to mitigate these attacks.
Use only ONE of the methods below.
For multi-line rules, please remember that order is important! Check your rules after insertion to confirm they are in the correct order, or you will have undesirable results.
Iptables Rules - Method 1
iptables -A OUTPUT -p udp --source-port 53 -m string --algo kmp --from 30 --to 31 --hex-string "|8105|" -j DROP iptables -I INPUT -p udp -m string --hex-string "|00000000000103697363036f726700|" --algo bm --to 65535 --dport 53 -j DROP iptables -I INPUT -p udp -m string --hex-string "|0000000000010472697065036e6574|" --algo bm --to 65535 --dport 53 -j DROP
Iptables Rules - Method 2
# block response when allow-query { acl; }; is used
iptables -A OUTPUT -m u32 -p udp --sport 53 --u32 "28&0xFFFF=0x8105" -j DROP
# block non recursive response when allow-query { any; }; is used
iptables -A OUTPUT -m u32 -p udp --sport 53 --u32 "28&0xFFFF=0x8100" -j DROP
# block truncated message requests
iptables -A OUTPUT -m u32 -p udp --sport 53 --u32 "28&0xFFFF=0x8300" -j DROP