How to protect DNS server on BIND from DDoS?

A

Alexey Andrianov2014-01-31 09:44:17

Domain Name System

Alexey Andrianov, 2014-01-31 09:44:17

There is a DNS server with BIND9, it has only 5-6 domain zones.
There is fail2ban, which is configured to read security.log
. How to write rules in named.conf so that domains that are on this DNS are processed normally, and left requests (domains that are not on DNS are poured into security.log)?

Reply

Answer the question

In order to leave comments, you need to log in

2 answer(s)

V

Vitaly Niksenkin, 2014-01-31
@404666

https://www.cloudflare.com/hosting-partners use this service's API

2

26info, 2014-02-09
@26info

If there is a "high-quality" DDoS, then there is no way to protect, and a trifle of 20-30 megabits is destroyed through iptables, but I remember (a couple of years ago it was), when attacking over a hundred megabits, nothing but the curator (aniddos service) helped :) As a result, then DDoS of several gigabits was repulsed (if the memory does not fail), and dns was kept from the provider, which solves its own problems :).