4

Hope someone can clarify.

As I understand, in a DNS DDos Amplification attacks

  1. Multiple DNS queries are sent to a vulnerable name server with the source IP spoofed to that of the target server.
  2. The name server returns the response (with source port UDP 53) to the target server.
  3. To the target server, the name server has originated a connection with source port UDP 53

For the target server firewall, does it make sense to block all originating traffic with source port 53? In fact, can we block any incoming traffic that has source port below 1024?

Improve this question

2 Answers 2

Reset to default
2

Yes!

If your server is a recursive server, block ALL queries from unknown/untrusted sources, regardless of source port. You should also block queries, even from trusted sources, with a source port of 53.

If your server is an authoritative server, yes, you should still block queries with a source port of 53.

In fact, you should block queries with any privileged source port, and even some unprivileged source ports. For instance, 5060 (SIP) is also a good source port to block.

Here's why:

Your server will send its answer back to the source IP and port. Due to the nature of UDP, both can be forged.

In a DDoS attack on a third party's nameserver, the attacker may forge the victim's IP, and the victim service's (DNS) port (UDP 53) and send a query to your server. Your server will then send the (much larger) answer to victim server, and unwittingly become a weapon in the DDoS attack itself.

The very vast majority of nameservers send queries from a random unprivileged source port.. The mere fact that a query purports to be from UDP 53 is itself a strong indicator that it is malicious.

Blocking in this manner won't do much to protect your server from being the victim of a DDoS, but will do help protect your server from being used to help perpetrate a DDoS

Improve this answer
1
  • I'm currently under what I think as a massive DDoS attack via DNS in what looks like an amplification attack (10,000,000 hits in about 12 hours) and the source ports used are all over the spectrum... Hits with SRC=53? Three out of some 62,952 different ports used. (from my current log with only about 262,000 of those hits, certainly a little more if I were to look at more logs). So I guess I'm the target and not one of the amplifiers, correct?
    – Alexis Wilke
    Commented Aug 15, 2020 at 22:51
1

Blocking all originating traffic with source port 53 will not solve your issue.

DNS Amplification attack is sort of a volumatric DDOS attack, no matter how good your firewall can block/handle the bad traffic, your pipeline will still be bursted.

You want to block the DNS spoof traffics as close to the internet edge as possible.

  1. Try contact the ISP for help to reject any DNS traffic with spoofed addresses
  2. Implement blackhole routing at the internet edge router if your router can handle it

If yours is a web server, try subscribe to services like CloudFlare, they should be able to handle such big volume DDoS protection

Improve this answer
2
  • 2
    Someone downvoted this without saying why. I've just upvoted again since bandwidth consumption is the problem with amplification attacks just as hoa says (applies to NTP as well as DNS) and this is not mentioned in the other answer here (by Joe Sniderman, who does provide good advice though). While its not a complete answer (blocking packets with a source port of 53 when you're delegating your DNS lookups is still a good idea) I for one would be very interested to know why this was downvoted.
    – symcbean
    Commented Apr 20, 2014 at 22:21
  • @symcbean The downvote may be because of the Try contact the ISP for help to reject any DNS traffic with spoofed addresses statement. I don't think an ISP can do that unless you know the source of the attack and that's precisely what you do not have here.
    – Alexis Wilke
    Commented Aug 15, 2020 at 23:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .