3

I had ast week the situation that a user accidentally got our DNS server to its knees by sending over 270K DNS queries to our dnsmasq. I was looking for a reliable method to prevent this Happening in the future. Is there any way to do this with a procurve 8212zl? Or maybe directly on dnsmasq?

This is a simple diagram of the network and the vlans in the network

enter image description here

All the edge switches are HP procurve an not cisco. All Vlans are available on other HQ switches except vlan 10.100.100.0/24, which is available only on the core switch. All other Vlans are end user vlans depending on the department.

Many thanks

  • You'll need to give us details about your network. A diagram would be great. – Zac67 Apr 10 '18 at 11:01
1

You are expecting too much from a switch at layer 2, though with L3 functionality, access control is very limited at protocol and transport levels.

According to your statements, you have DNSMasq running, so there must be a Linux box with firewall and all. You better rate limit incoming DNS queries on a per host basis using either iptables or tc or both, and let the switches do best of their switching instead.

Here's one possible solution, and here's another.

  • Well the core switch is doing obviously layer 3, the power connect is used to do so as well, but we moved all routes to the firewall and to the core switch, the force 10 are layer 2 as well. So it seems the only way of limiting DNS traffic is with iptables, which means I need another Linux machine in front of it, otherwise it would be too late to handle the queries on the Dnsmasq VM itself. – Max Apr 11 '18 at 8:09
  • Thanks for the links. I saw them the last days, I just thought it would be possible to block it at switch level, before they get to the Dnsmasq. – Max Apr 11 '18 at 8:10
  • As iptables run at kernel level before and after network drivers, it can handle packets before it reaches dnsmasq or any app on the system. No need for an extra Linux machine. – MTG Apr 11 '18 at 10:21
  • That is correct, but I don't want to waste Kernel cycles and CPU on dropping traffic. I am planing to move the Dnsmasq to a different zone behind the firewall like most of our apps and make the firewall do the job. Thanks for the reply – Max Apr 11 '18 at 11:01
  • I believe performance won't be a concern at all. Once you drop a teaser, it will not try that much again, also because of connection tracking, iptables acts optimally afterwards. – MTG Apr 13 '18 at 7:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.