<div dir="ltr">Unfortunately, the changes didn't yield much results. The flood attack happened again but at a different time.<div><br></div><div>Any more suggestions?</div><div><br></div><div>Regards,</div><div>izake</div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Mon, Mar 24, 2025 at 12:18 PM sir izake <<a href="mailto:sirizake@gmail.com">sirizake@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">thank you all<div><br></div><div>"unbound-control get_option access-control" shows a list of IP blocks I have allowed/denied.</div><div><br></div><div>I have also done the explicit deny and recommended config hardening.</div><div><br></div><div>I will monitor and see if the issue reoccurs.</div><div><br></div><div>Thank you</div><div>izake</div><div><br></div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Mar 24, 2025 at 10:48 AM <<a href="mailto:unbound-users-request@lists.nlnetlabs.nl" target="_blank">unbound-users-request@lists.nlnetlabs.nl</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Send Unbound-users mailing list submissions to<br>
<a href="mailto:unbound-users@lists.nlnetlabs.nl" target="_blank">unbound-users@lists.nlnetlabs.nl</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://lists.nlnetlabs.nl/mailman/listinfo/unbound-users" rel="noreferrer" target="_blank">https://lists.nlnetlabs.nl/mailman/listinfo/unbound-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:unbound-users-request@lists.nlnetlabs.nl" target="_blank">unbound-users-request@lists.nlnetlabs.nl</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:unbound-users-owner@lists.nlnetlabs.nl" target="_blank">unbound-users-owner@lists.nlnetlabs.nl</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of Unbound-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Unbound dns resolver involved in DNS Amplification attack<br>
(sir izake)<br>
2. Re: Unbound dns resolver involved in DNS Amplification attack<br>
(Yuri)<br>
3. Re: Unbound dns resolver involved in DNS Amplification attack<br>
(Cristiano Deana)<br>
4. Re: Unbound dns resolver involved in DNS Amplification attack<br>
(Yuri)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Mon, 24 Mar 2025 10:18:38 +0000<br>
From: sir izake <<a href="mailto:sirizake@gmail.com" target="_blank">sirizake@gmail.com</a>><br>
To: <a href="mailto:unbound-users@lists.nlnetlabs.nl" target="_blank">unbound-users@lists.nlnetlabs.nl</a><br>
Subject: Unbound dns resolver involved in DNS Amplification attack<br>
Message-ID:<br>
<<a href="mailto:CAACQ5hCU_6i_hqapFUaqwEZHeE_WD9MQDAUo4njJigH8CmZDeA@mail.gmail.com" target="_blank">CAACQ5hCU_6i_hqapFUaqwEZHeE_WD9MQDAUo4njJigH8CmZDeA@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Hi<br>
<br>
I run an unbound dns cache resolver (version 1.22.0) on a freebsd 14.2<br>
server. It is configured to only respond to queries from the local host and<br>
my network IP block.<br>
<br>
Recently, I detected my server was involved in a DNS amplification attack.<br>
By default unbound doesn't respond to any query outside those allowed in<br>
the access list in the config file. How do I uncover the source IPs<br>
involved and potentially block them.<br>
<br>
Are there other options I need to enable to prevent further amplification<br>
attacks?<br>
<br>
I have checked the server and don't see any suspicious process running.<br>
<br>
Your support and advice is greatly appreciated.<br>
<br>
Regards<br>
izake<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.nlnetlabs.nl/pipermail/unbound-users/attachments/20250324/a68a1439/attachment-0001.htm" rel="noreferrer" target="_blank">http://lists.nlnetlabs.nl/pipermail/unbound-users/attachments/20250324/a68a1439/attachment-0001.htm</a>><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Mon, 24 Mar 2025 15:32:42 +0500<br>
From: Yuri <<a href="mailto:yvoinov@gmail.com" target="_blank">yvoinov@gmail.com</a>><br>
To: <a href="mailto:unbound-users@lists.nlnetlabs.nl" target="_blank">unbound-users@lists.nlnetlabs.nl</a><br>
Subject: Re: Unbound dns resolver involved in DNS Amplification attack<br>
Message-ID: <<a href="mailto:c957df77-cc37-4d5a-9dc0-8f3e78f0cec0@gmail.com" target="_blank">c957df77-cc37-4d5a-9dc0-8f3e78f0cec0@gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"; Format="flowed"<br>
<br>
To begin, restrict access from outside using standard Unbound <br>
configuration (example from one of my setups):<br>
<br>
??? access-control: <a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a> refuse<br>
??? access-control: <a href="http://127.0.0.0/8" rel="noreferrer" target="_blank">127.0.0.0/8</a> allow_snoop<br>
??? access-control: <a href="http://192.168.0.0/16" rel="noreferrer" target="_blank">192.168.0.0/16</a> allow_snoop<br>
??? access-control: <a href="http://172.16.0.0/12" rel="noreferrer" target="_blank">172.16.0.0/12</a> allow_snoop<br>
??? access-control: ::0/0 refuse<br>
??? access-control: ::1 allow<br>
??? access-control: ::ffff:127.0.0.1 allow<br>
<br>
Additionally, cut off external access with a server firewall and/or on <br>
the border. And finally, check the internal network to see if it is trooped.<br>
<br>
24.03.2025 15:18, sir izake via Unbound-users ?????:<br>
> Hi<br>
><br>
> I run an unbound dns cache resolver (version 1.22.0) on a freebsd 14.2 <br>
> server. It is configured to only respond to queries from the local <br>
> host and my network IP block.<br>
><br>
> Recently, I detected my server was involved in a DNS amplification <br>
> attack.? By default unbound doesn't respond to any query outside those <br>
> allowed in the access list in the config file. How do I uncover the <br>
> source IPs involved and potentially block them.<br>
><br>
> Are there other options I need to enable to prevent further <br>
> amplification attacks?<br>
><br>
> I have checked the server and don't?see any suspicious process running.<br>
><br>
> Your support and advice is greatly appreciated.<br>
><br>
> Regards<br>
> izake<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.nlnetlabs.nl/pipermail/unbound-users/attachments/20250324/45920e7f/attachment-0001.htm" rel="noreferrer" target="_blank">http://lists.nlnetlabs.nl/pipermail/unbound-users/attachments/20250324/45920e7f/attachment-0001.htm</a>><br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Mon, 24 Mar 2025 11:33:26 +0100<br>
From: Cristiano Deana <<a href="mailto:cristiano.deana@megaweb.it" target="_blank">cristiano.deana@megaweb.it</a>><br>
To: <a href="mailto:unbound-users@lists.nlnetlabs.nl" target="_blank">unbound-users@lists.nlnetlabs.nl</a><br>
Subject: Re: Unbound dns resolver involved in DNS Amplification attack<br>
Message-ID: <<a href="mailto:b25581c2-8068-440a-b590-f0e3ad612b90@megaweb.it" target="_blank">b25581c2-8068-440a-b590-f0e3ad612b90@megaweb.it</a>><br>
Content-Type: text/plain; charset=UTF-8; format=flowed<br>
<br>
Il 24/03/2025 11:18, sir izake via Unbound-users ha scritto:<br>
<br>
Hi,<br>
<br>
> I run an unbound dns cache resolver (version 1.22.0) on a freebsd 14.2 <br>
> server. It is configured to only respond to queries from the local host <br>
> and my network IP block.<br>
<br>
what do you get with `unbound-control get_option access-control'?<br>
<br>
> Recently, I detected my server was involved in a DNS amplification <br>
> attack.? By default unbound doesn't respond to any query outside those <br>
> allowed in the access list in the config file. How do I uncover the <br>
> source IPs involved and potentially block them.<br>
> <br>
> Are there other options I need to enable to prevent further <br>
> amplification attacks?<br>
> <br>
> I have checked the server and don't?see any suspicious process running.<br>
> <br>
> Your support and advice is greatly appreciated.<br>
> <br>
> Regards<br>
> izake<br>
<br>
-- <br>
<br>
###############################<br>
# Cristiano Deana #<br>
# #<br>
# Senior Network Engineer #<br>
# Digital Response Team #<br>
# CittaStudi S.p.a. #<br>
# off. +39 015 855 1172 #<br>
# cell +39 328 310 6392 #<br>
###############################<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Mon, 24 Mar 2025 15:48:03 +0500<br>
From: Yuri <<a href="mailto:yvoinov@gmail.com" target="_blank">yvoinov@gmail.com</a>><br>
To: <a href="mailto:unbound-users@lists.nlnetlabs.nl" target="_blank">unbound-users@lists.nlnetlabs.nl</a><br>
Subject: Re: Unbound dns resolver involved in DNS Amplification attack<br>
Message-ID: <<a href="mailto:55c63a28-03e3-4bbf-9b58-80b5786c9e4b@gmail.com" target="_blank">55c63a28-03e3-4bbf-9b58-80b5786c9e4b@gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"; Format="flowed"<br>
<br>
Ah, I was inattentive. It seems to me that a consistent set of actions <br>
is needed here, as in the case of an incident. Listening to traffic - in <br>
order to catch illegitimate traffic and try to determine its source. <br>
Scanning the external access point for open ports. Checking the firewall <br>
and routing settings. And - yes, of course, it is worth starting with <br>
checking the config and its hardening.<br>
<br>
24.03.2025 15:33, Cristiano Deana via Unbound-users ?????:<br>
> Il 24/03/2025 11:18, sir izake via Unbound-users ha scritto:<br>
><br>
> Hi,<br>
><br>
>> I run an unbound dns cache resolver (version 1.22.0) on a freebsd <br>
>> 14.2 server. It is configured to only respond to queries from the <br>
>> local host and my network IP block.<br>
><br>
> what do you get with `unbound-control get_option access-control'?<br>
><br>
>> Recently, I detected my server was involved in a DNS amplification <br>
>> attack.? By default unbound doesn't respond to any query outside <br>
>> those allowed in the access list in the config file. How do I uncover <br>
>> the source IPs involved and potentially block them.<br>
>><br>
>> Are there other options I need to enable to prevent further <br>
>> amplification attacks?<br>
>><br>
>> I have checked the server and don't?see any suspicious process running.<br>
>><br>
>> Your support and advice is greatly appreciated.<br>
>><br>
>> Regards<br>
>> izake<br>
><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.nlnetlabs.nl/pipermail/unbound-users/attachments/20250324/b2d8cd29/attachment.htm" rel="noreferrer" target="_blank">http://lists.nlnetlabs.nl/pipermail/unbound-users/attachments/20250324/b2d8cd29/attachment.htm</a>><br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
Unbound-users mailing list<br>
<a href="mailto:Unbound-users@lists.nlnetlabs.nl" target="_blank">Unbound-users@lists.nlnetlabs.nl</a><br>
<a href="https://lists.nlnetlabs.nl/mailman/listinfo/unbound-users" rel="noreferrer" target="_blank">https://lists.nlnetlabs.nl/mailman/listinfo/unbound-users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of Unbound-users Digest, Vol 63, Issue 9<br>
********************************************<br>
</blockquote></div>
</blockquote></div>