<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><span class="HwtZe" lang="en"><span class="jCAhz ChMk0b"><span
class="ryNqvb">To begin, restrict access from outside using
standard Unbound configuration (example from one of my
setups):</span></span></span></p>
<p><span class="HwtZe" lang="en"><span class="jCAhz ChMk0b"><span
class="ryNqvb"> access-control: 0.0.0.0/0 refuse<br>
access-control: 127.0.0.0/8 allow_snoop<br>
access-control: 192.168.0.0/16 allow_snoop<br>
access-control: 172.16.0.0/12 allow_snoop<br>
access-control: ::0/0 refuse<br>
access-control: ::1 allow<br>
access-control: ::ffff:127.0.0.1 allow<br>
</span></span></span></p>
<p><span class="HwtZe" lang="en"><span class="jCAhz ChMk0b"><span
class="ryNqvb">Additionally, cut off external access with a
server firewall and/or on the border.</span></span> <span
class="jCAhz ChMk0b"><span class="ryNqvb">And finally, check
the internal network to see if it is trooped.</span></span></span></p>
<div class="moz-cite-prefix">24.03.2025 15:18, sir izake via
Unbound-users пишет:<br>
</div>
<blockquote type="cite"
cite="mid:CAACQ5hCU_6i_hqapFUaqwEZHeE_WD9MQDAUo4njJigH8CmZDeA@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">Hi
<div><br>
</div>
<div>I run an unbound dns cache resolver (version 1.22.0) on a
freebsd 14.2 server. It is configured to only respond to
queries from the local host and my network IP block. </div>
<div><br>
</div>
<div>Recently, I detected my server was involved in a DNS
amplification attack. By default unbound doesn't respond to
any query outside those allowed in the access list in the
config file. How do I uncover the source IPs involved and
potentially block them.</div>
<div><br>
</div>
<div>Are there other options I need to enable to prevent further
amplification attacks?</div>
<div><br>
</div>
<div>I have checked the server and don't see any suspicious
process running.</div>
<div><br>
</div>
<div>Your support and advice is greatly appreciated. </div>
<div><br>
</div>
<div>Regards</div>
<div>izake </div>
</div>
</blockquote>
</body>
</html>