<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><span class="HwtZe" lang="en"><span class="jCAhz ChMk0b"><span
class="ryNqvb">Ah, I was inattentive.</span></span> <span
class="jCAhz"><span class="ryNqvb">It seems to me that a
consistent set of actions is needed here, as in the case of
an incident.</span></span> <span class="jCAhz ChMk0b"><span
class="ryNqvb">Listening to traffic - in order to catch
illegitimate traffic and try to determine its source.</span></span>
<span class="jCAhz ChMk0b"><span class="ryNqvb">Scanning the
external access point for open ports.</span></span> <span
class="jCAhz ChMk0b"><span class="ryNqvb">Checking the
firewall and routing settings.</span></span> <span
class="jCAhz ChMk0b"><span class="ryNqvb">And - yes, of
course, it is worth starting with checking the config and
its hardening.</span></span></span></p>
<div class="moz-cite-prefix">24.03.2025 15:33, Cristiano Deana via
Unbound-users пишет:<br>
</div>
<blockquote type="cite"
cite="mid:b25581c2-8068-440a-b590-f0e3ad612b90@megaweb.it">Il
24/03/2025 11:18, sir izake via Unbound-users ha scritto:
<br>
<br>
Hi,
<br>
<br>
<blockquote type="cite">I run an unbound dns cache resolver
(version 1.22.0) on a freebsd 14.2 server. It is configured to
only respond to queries from the local host and my network IP
block.
<br>
</blockquote>
<br>
what do you get with `unbound-control get_option access-control'?
<br>
<br>
<blockquote type="cite">Recently, I detected my server was
involved in a DNS amplification attack. By default unbound
doesn't respond to any query outside those allowed in the access
list in the config file. How do I uncover the source IPs
involved and potentially block them.
<br>
<br>
Are there other options I need to enable to prevent further
amplification attacks?
<br>
<br>
I have checked the server and don't see any suspicious process
running.
<br>
<br>
Your support and advice is greatly appreciated.
<br>
<br>
Regards
<br>
izake
<br>
</blockquote>
<br>
</blockquote>
</body>
</html>