DNS Amplification Risk

# BIND Response Rate Limiting (RRL) - basic amplification protection
options {
  rate-limit {
    responses-per-second 10;           # Maximum responses per client per second (conservative)
    window 5;                          # Time window for rate calculations (5 seconds)
    log-only no;                       # Actually enforce limits (not just log violations)
    qps-scale 250;                     # Burst allowance scale factor (higher = more bursts)
    ipv4-prefix-length 24;             # Group IPv4 clients by /24 subnet (ISP level)
    ipv6-prefix-length 56;             # Group IPv6 clients by /56 subnet (typical delegation) 
    slip 2;                            # Send every 2nd response truncated (forces TCP retry)
  };
};

// Enhanced BIND Response Rate Limiting (RRL) for amplification protection
rate-limit {
  responses-per-second 5;     // Max normal responses per client per second (conservative setting)
  nxdomains-per-second 5;     // Limit NXDOMAIN responses (prevents subdomain enumeration attacks)
  errors-per-second 5;        // Limit error responses like SERVFAIL, REFUSED (prevents error abuse)
  referrals-per-second 5;     // Limit referral responses (prevents delegation chain abuse)
  window 15;                  // Time window for rate calculations (15 seconds for accuracy)
  slip 2;                     // Send every 2nd response truncated (TC=1, forces TCP retries)
  ipv4-prefix-length 24;      // Group IPv4 clients by /24 subnet (ISP/org level)
  ipv6-prefix-length 56;      // Group IPv6 clients by /56 subnet (typical delegation)
  qps-scale 250;              // Scale factor for burst allowance (250 = moderate bursts)
  all-per-second 10;          // Emergency limit: total responses per client (safety net)
  log-only no;                // Actually enforce limits (set to 'yes' for testing)
  exempt-clients { localhost; 192.168.0.0/16; }; // Exempt trusted networks from RRL
};

// Access Control Lists - define trusted networks for DNS services
acl "trusted" {
  localhost;          // Local server (127.0.0.1/8, ::1/128) - always trusted
  192.168.0.0/16;     // RFC 1918 Class C private networks (home/office LANs)
  10.0.0.0/8;         // RFC 1918 Class A private networks (large enterprises)
  172.16.0.0/12;      // RFC 1918 Class B private networks (medium organizations)
  // Add specific public IPs for legitimate remote access
  // 203.0.113.100/32;   // Example: specific trusted public IP
};

acl "internal_servers" {
  192.168.1.10;       // Internal DNS server #1
  192.168.1.11;       // Internal DNS server #2 
  10.0.0.53;          // Primary internal resolver
  // List all internal DNS infrastructure here
};

acl "blackhole" {
  // Known amplification source networks (update from threat intelligence)
  203.0.113.0/24;     // Example bad network (TEST-NET-3 - RFC documentation)
  192.0.2.0/24;       // Example bad network (TEST-NET-1 - RFC documentation)
  198.51.100.0/24;    // Example bad network (TEST-NET-2 - RFC documentation)
  // Add real threat intelligence sources:
  // include "/etc/bind/blacklist.acl";  // External blacklist file
};

options {
  // Recursion controls - critical for preventing open resolver abuse
  allow-recursion { trusted; internal_servers; };    // Only authorized networks can recurse
  allow-query-cache { trusted; internal_servers; };  // Only authorized networks access cache
  allow-query { any; };                               // Authoritative queries from any source
  recursion yes;                                      // Enable recursion (but only for trusted)
  
  // Source address controls
  allow-transfer { internal_servers; };               // Zone transfers only to internal servers
  allow-notify { internal_servers; };                 // Accept notifications from internal only
  
  // Block known bad sources immediately
  blackhole { blackhole; };                           // Drop all packets from blacklisted networks
  
  // Performance and DoS protection limits
  max-cache-size 256m;                                // Cache size limit (adjust based on RAM)
  clients-per-query 10;                               // Max clients per identical query
  max-clients-per-query 100;                          // Absolute max clients for same query
  recursive-clients 1000;                             // Max concurrent recursive queries
  tcp-clients 100;                                    // Max concurrent TCP connections
  
  // Query complexity limits
  max-recursion-depth 7;                              // Prevent infinite recursion loops
  max-recursion-queries 75;                           // Max queries per recursion chain
  fetches-per-zone 10;                                // Max concurrent zone fetches
  
  // Additional anti-amplification measures
  minimal-responses yes;                               // Reduce response sizes where possible
  version "DNS Server";                                // Don't reveal BIND version
  hostname "";                                        // Don't reveal server hostname
};

// Query type filtering - block amplification-prone record types
view "restricted" {
    match-clients { any; };                              # Apply to all clients (global filter)
    allow-query { any; };                               # Allow queries but with restrictions
    
    // Block or limit high-amplification record types
    zone "." {
        type static-stub;                               # Create static responses for filtering
        server-addresses { };                           # Empty server list blocks resolution
        zone-policy policy-name {                       # Apply custom policy
            policy-action drop;                         # Drop certain query types
            query-type TXT;                             # Block TXT record queries (DKIM keys)
            query-type ANY;                             # Block ANY queries (highest amplification)
            query-type RRSIG;                           # Block DNSSEC signature queries
        };
    };
    
    // Rate limit specific record types instead of blocking
    rate-limit {
        responses-per-second 2;                         # Stricter limit for high-risk types
        window 10;                                      # Longer window for persistent attacks
        slip 3;                                         # More aggressive truncation (every 3rd)
        exempt-clients { localhost; 192.168.0.0/16; }; # Exempt trusted internal networks
    };
};

// Alternative: Use RPZ (Response Policy Zone) for advanced filtering
zone "rpz.local" {
    type master;                                        # Master zone for RPZ rules
    file "/etc/bind/db.rpz";                           # RPZ rule file location
    allow-query { localhost; };                         # Restrict RPZ zone queries
    allow-transfer { none; };                           # Prevent zone transfers of RPZ data
};
  qps-scale 100;
  // Apply stricter limits to ANY queries
  all-per-second 1;
};

# iptables rate limiting for DNS amplification protection
iptables -A INPUT -p udp --dport 53 -m hashlimit \
  --hashlimit-upto 30/min \          # Allow 30 queries per minute per IP
  --hashlimit-burst 10 \             # Allow burst of 10 queries initially
  --hashlimit-mode srcip \           # Rate limit per source IP address
  --hashlimit-name dns \             # Named rule for tracking state
  --hashlimit-htable-expire 300000 \ # Hash table cleanup (5 minutes)
  -j ACCEPT

# Block excessive queries (amplification attempts)
iptables -A INPUT -p udp --dport 53 -j DROP

# TCP DNS protection (separate chain for stateful connection tracking)
iptables -A INPUT -p tcp --dport 53 -m state --state NEW \
  -m hashlimit --hashlimit-upto 10/min \      # Lower TCP rate (resource intensive)
  --hashlimit-burst 5 --hashlimit-mode srcip \ 
  --hashlimit-name dns-tcp -j ACCEPT

# Example fail2ban filter for DNS abuse
# Monitor for excessive queries from single IP
[Definition]
failregex = client .* query.*from <HOST>
ignoreregex = 
maxretry = 100
findtime = 60
bantime = 3600