Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Hope someone can clarify.

As I understand, in a DNS DDos Amplification attacks

  1. Multiple DNS queries are sent to a vulnerable name server with the source IP spoofed to that of the target server.
  2. The name server returns the response (with source port UDP 53) to the target server.
  3. To the target server, the name server has originated a connection with source port UDP 53

For the target server firewall, does it make sense to block all originating traffic with source port 53? In fact, can we block any incoming traffic that has source port below 1024?

share|improve this question

2 Answers 2

Yes!

If your server is a recursive server, block ALL queries from unknown/untrusted sources, regardless of source port. You should also block queries, even from trusted sources, with a source port of 53.

If your server is an authoritative server, yes, you should still block queries with a source port of 53.

In fact, you should block queries with any privileged source port, and even some unprivileged source ports. For instance, 5060 (SIP) is also a good source port to block.

Here's why:

Your server will send its answer back to the source IP and port. Due to the nature of UDP, both can be forged.

In a DDoS attack on a third party's nameserver, the attacker may forge the victim's IP, and the victim service's (DNS) port (UDP 53) and send a query to your server. Your server will then send the (much larger) answer to victim server, and unwittingly become a weapon in the DDoS attack itself.

The very vast majority of nameservers send queries from a random unprivileged source port.. The mere fact that a query purports to be from UDP 53 is itself a strong indicator that it is malicious.

Blocking in this manner won't do much to protect your server from being the victim of a DDoS, but will do help protect your server from being used to help perpetrate a DDoS

share|improve this answer

Blocking all originating traffic with source port 53 will not solve your issue.

DNS Amplification attack is sort of a volumatric DDOS attack, no matter how good your firewall can block/handle the bad traffic, your pipeline will still be bursted.

You want to block the DNS spoof traffics as close to the internet edge as possible.

  1. Try contact the ISP for help to reject any DNS traffic with spoofed addresses
  2. Implement blackhole routing at the internet edge router if your router can handle it

If yours is a web server, try subscribe to services like CloudFlare, they should be able to handle such big volume DDoS protection

share|improve this answer
1  
Someone downvoted this without saying why. I've just upvoted again since bandwidth consumption is the problem with amplification attacks just as hoa says (applies to NTP as well as DNS) and this is not mentioned in the other answer here (by Joe Sniderman, who does provide good advice though). While its not a complete answer (blocking packets with a source port of 53 when you're delegating your DNS lookups is still a good idea) I for one would be very interested to know why this was downvoted. –  symcbean Apr 20 at 22:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.