How to Fix Open DNS Resolvers
Written by: Will Kruss on 21 May 2014 11:11 AM
Your VPS may attack against other networks while running open DNS resolver. Follow instructions on resolving problem.
Please note: If you are advised you are running an open DNS resolver you must take action as your VPS is most likely being used in attacks against other networks. Please read below for an explanation and instructions on resolving the problem.
An "open DNS resolver" is a DNS server that's willing to resolve recursive DNS lookups for anyone on the internet. It's much like an open SMTP relay, in that the simple lack of authentication allows malicious 3rd parties to propagate their payloads using your unsecured equipment. With open SMTP relays, the problem is that they forward spam. With open DNS resolvers, the problem is that they allow a denial of service attack known as a DNS Amplification Attack.
The way this attack works is pretty simple - because your server will resolve recursive DNS queries from anyone, an attacker can cause it to participate in a DDoS by sending your server a recursive DNS query that will return a large amount of data, much larger than the original DNS request packet. By spoofing (faking) their IP address, they'll direct this extra traffic to their victim's computers instead of their own, and of course, they'll make as many requests as fast as they can to your server, and any other open DNS resolvers they can find. In this manner, someone with a relatively small pipe can "amplify" a denial of service attack by using all the bandwidth on their pipe to direct a much larger volume of traffic at their victims.
ArsTechnica did a decent article on the recent DNS Amplification DDoS attack against Spamhaus, and is worth a quick read to get the basics (and a good visual of the amplification).
The simplest way to protect your system from being abused like this is to limit the addresses your server will perform recursive lookups for to your local subnets. (The specifics of which depend on which DNS server you're using, of course).
For example, if I were using BIND 9, and wanted to simply prevent DNS recursion from outside addresses, I would use the following code in my config:
That line of code tells my BIND server to only process recursive DNS requests for the local loopback address (which I guess I could/should set to the local loopback block, the whole /8) and the 3 Private IPv4 address spaces.
Windows Server 2012
1. Block external DNS requests with a firewall, such as the built in Windows firewall (use this method if you are running a domain controller and are NOT using the DNS server as an actual name server for public domains)
To my surprise, Windows DNS does not allow you to restrict the addresses to which recursive DNS requests are honored, so this actually the recommended method by Microsoft.
2. Disable Recursion (use this method if your DNS server is used as a name server for a public domain)
Disabling recursion is good when your DNS server is a public facing DNS server, only providing DNS information for zones it actually hosts (is authoritative for). If your system is a Domain Controller then you must make sure you have another DNS server specified in the network settings other than 127.0.0.1 or it will not be able to resolve any other domains, or use option 1 above. If your server is NOT a domain controller then this is the easiest option as it prevents your DNS server from providing any information other than about the zones it hosts.