Re: recursive DNS servers DDoS as a growing DDoS problem

[Jim Pingle <jim () hpcisp com>]

Geo. wrote:
> > We have done just this (block inbound udp/53) to certain subnets due to a
> > rash of CPEs that happily proxy DNS, including recursive queries,
> > from their WAN side.
>
> What devices? Is this a default or something customers are configuring?

Just about every Siemens/Efficient *DSL router (5851, 5871, 5890, some
others) I have seen does this by default. During one attack I logged into a
router and changed the DNS servers used for DHCP from both, to one, to the
other, and watched its traffic flow exactly where I pointed the DNS servers.

These routers also have a bad habit of hijacking DNS requests for anything
in the form of <routername>.anydomain.com. Even if the DNS request is sent
to an ISP name server, it will still return a record pointing to its own LAN
IP when queried for, i.e. foo.bork.com and foo.microsoft.com if you named
the router "foo".

It's not only done by default, it's not a configurable behavior as far as
I've been able to find. The fix we were supplied with was to block inbound
udp/53 using the router's internal IP filtering, and to name the router
something unique (i.e. a customer's order number).

Jim