BIND и DOS

[savio]

Со вчерашнего дня DNS трафик на моем сервере составил 2Мб/с
Был даже пик на протяжении 40 минут - 7.5Мбит

По логам 130 запросов в минуту

Код: Выделить всё

...
Aug  5 00:53:38 savio named[1980]: queries: info: client 174.122.219.187#53: query: ripe.net IN ANY +ED (xxx.xxx.xxx.xxx)
Aug  5 00:53:38 savio named[1980]: queries: info: client 85.112.68.250#53: query: ripe.net IN ANY +ED (xxx.xxx.xxx.xxx)
Aug  5 00:53:38 savio named[1980]: queries: info: client 209.200.153.21#53: query: ripe.net IN ANY +ED (xxx.xxx.xxx.xxx)
Aug  5 00:53:38 savio named[1980]: queries: info: client 188.135.10.42#53: query: ripe.net IN ANY +ED (xxx.xxx.xxx.xxx)
Aug  5 00:53:38 savio named[1980]: queries: info: client 209.200.153.21#53: query: ripe.net IN ANY +ED (xxx.xxx.xxx.xxx)
Aug  5 00:53:38 savio named[1980]: queries: info: client 213.130.121.233#53: query: ripe.net IN ANY +ED (xxx.xxx.xxx.xxx)
Aug  5 00:53:38 savio named[1980]: queries: info: client 209.200.153.21#53: query: ripe.net IN ANY +ED (xxx.xxx.xxx.xxx)
Aug  5 00:53:38 savio named[1980]: queries: info: client 174.122.219.187#53: query: ripe.net IN ANY +ED (xxx.xxx.xxx.xxx)
Aug  5 00:53:38 savio named[1980]: queries: info: client 188.135.10.42#53: query: ripe.net IN ANY +ED (xxx.xxx.xxx.xxx)
Aug  5 00:53:38 savio named[1980]: queries: info: client 85.112.68.250#53: query: ripe.net IN ANY +ED (xxx.xxx.xxx.xxx)
Aug  5 00:53:38 savio named[1980]: queries: info: client 213.130.121.233#53: query: ripe.net IN ANY +ED (xxx.xxx.xxx.xxx)
Aug  5 00:53:38 savio named[1980]: queries: info: client 209.200.153.21#53: query: ripe.net IN ANY +ED (xxx.xxx.xxx.xxx)
Aug  5 00:53:38 savio named[1980]: queries: info: client 213.130.121.233#53: query: ripe.net IN ANY +ED (xxx.xxx.xxx.xxx)
Aug  5 00:53:38 savio named[1980]: queries: info: client 209.200.153.21#53: query: ripe.net IN ANY +ED (xxx.xxx.xxx.xxx)
Aug  5 00:53:38 savio named[1980]: queries: info: client 188.135.10.42#53: query: ripe.net IN ANY +ED (xxx.xxx.xxx.xxx)

...

Забанил следующие ip в ipfw

217.17.247.134
63.166.155.165
59.125.32.146
209.200.153.2
23.20.43.112
168.187.240.89
209.200.153.21
188.135.10.42
174.122.219.187
213.130.121.233
85.112.68.250

Я думаю что это дос-атака. Со мной такое впервые.
Есть ли какие-то другие способы борьбы в такой ситуации.
Думаю блокировка в ipfw ничего не даст, так как трафик всеравно будет идти ко мне

[Хостинг HostFood.ru]

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

[savio]

Через час продолжение следовала. Еще 12 айпишек забанил.

[lap]

тут уже обсуждалось что-то подобное, правда помоему никчему так и не пришли
У меня лист уже так выглядит:

Код: Выделить всё

 deny   udp host 1.2.3.4 any eq domain
 deny   udp host 31.204.128.176 any eq domain
 deny   udp host 37.157.244.66 any eq domain
 deny   udp host 37.220.16.12 any eq domain
 deny   udp host 37.220.6.146 any eq domain
 deny   udp host 41.129.17.167 any eq domain
 deny   udp host 46.105.36.36 any eq domain
 deny   udp host 46.166.155.108 any eq domain
 deny   udp host 46.26.86.116 any eq domain
 deny   udp host 50.115.118.4 any eq domain
 deny   udp host 50.97.132.154 any eq domain
 deny   udp host 62.129.168.216 any eq domain
 deny   udp host 62.75.235.212 any eq domain
 deny   udp host 64.40.12.104 any eq domain
 deny   udp host 64.40.2.12 any eq domain
 deny   udp host 64.40.2.22 any eq domain
 deny   udp host 64.94.100.206 any eq domain
 deny   udp host 66.45.251.210 any eq domain
 deny   udp host 67.213.215.56 any eq domain
 deny   udp host 67.215.13.106 any eq domain
 deny   udp host 67.220.78.172 any eq domain
 deny   udp host 67.228.201.20 any eq domain
 deny   udp host 67.228.201.208 any eq domain
 deny   udp host 67.228.201.209 any eq domain
 deny   udp host 67.228.201.214 any eq domain
 deny   udp host 68.68.17.49 any eq domain
 deny   udp host 68.68.27.87 any eq domain
 deny   udp host 69.175.20.10 any eq domain
 deny   udp host 69.175.54.242 any eq domain
 deny   udp host 69.4.230.110 any eq domain
 deny   udp host 69.55.53.49 any eq domain
 deny   udp host 72.20.33.85 any eq domain
 deny   udp host 74.115.1.47 any eq domain
 deny   udp host 74.55.127.194 any eq domain
 deny   udp host 74.85.154.42 any eq domain
 deny   udp host 77.206.107.9 any eq domain
 deny   udp host 77.206.107.92 any eq domain
 deny   udp host 78.159.108.32 any eq domain
 deny   udp host 78.222.72.214 any eq domain
 deny   udp host 78.230.46.173 any eq domain
 deny   udp host 78.232.66.54 any eq domain
 deny   udp host 78.233.253.35 any eq domain
 deny   udp host 78.236.223.135 any eq domain
 deny   udp host 78.239.247.198 any eq domain
 deny   udp host 78.247.236.179 any eq domain
 deny   udp host 78.248.136.90 any eq domain
 deny   udp host 78.250.221.10 any eq domain
 deny   udp host 78.251.123.4 any eq domain
 deny   udp host 78.251.225.77 any eq domain
 deny   udp host 80.236.108.223 any eq domain
 deny   udp host 80.237.157.67 any eq domain
 deny   udp host 81.93.244.220 any eq domain
 deny   udp host 81.93.251.98 any eq domain
 deny   udp host 82.165.139.125 any eq domain
 deny   udp host 82.165.27.129 any eq domain
 deny   udp host 82.192.74.83 any eq domain
 deny   udp host 82.52.152.194 any eq domain
 deny   udp host 83.169.61.47 any eq domain
 deny   udp host 83.196.219.78 any eq domain
 deny   udp host 85.17.225.104 any eq domain
 deny   udp host 85.25.137.51 any eq domain
 deny   udp host 85.25.151.48 any eq domain
 deny   udp host 85.25.152.63 any eq domain
 deny   udp host 85.25.242.233 any eq domain
 deny   udp host 85.52.201.214 any eq domain
 deny   udp host 86.68.241.5 any eq domain
 deny   udp host 87.106.165.144 any eq domain
 deny   udp host 87.106.20.236 any eq domain
 deny   udp host 87.230.55.91 any eq domain
 deny   udp host 87.230.55.93 any eq domain
 deny   udp host 87.98.152.38 any eq domain
 deny   udp host 87.98.155.38 any eq domain
 deny   udp host 87.98.181.40 any eq domain
 deny   udp host 88.122.226.97 any eq domain
 deny   udp host 88.164.138.141 any eq domain
 deny   udp host 88.190.31.35 any eq domain
 deny   udp host 88.190.36.129 any eq domain
 deny   udp host 88.190.39.174 any eq domain
 deny   udp host 88.191.135.213 any eq domain
 deny   udp host 88.191.144.92 any eq domain
 deny   udp host 90.18.255.147 any eq domain
 deny   udp host 90.58.241.204 any eq domain
 deny   udp host 91.121.151.70 any eq domain
 deny   udp host 91.205.172.74 any eq domain
 deny   udp host 93.173.88.103 any eq domain
 deny   udp host 93.174.88.103 any eq domain
 deny   udp host 94.23.197.68 any eq domain
 deny   udp host 95.168.179.62 any eq domain
 deny   udp host 95.211.148.148 any eq domain
 deny   udp host 95.252.151.130 any eq domain
 deny   udp host 108.170.36.146 any eq domain
 deny   udp host 108.61.17.91 any eq domain
 deny   udp host 109.15.154.11 any eq domain
 deny   udp host 109.200.206.194 any eq domain
 deny   udp host 109.200.206.235 any eq domain
 deny   udp host 109.236.31.193 any eq domain
 deny   udp host 109.73.72.58 any eq domain
 deny   udp host 127.0.0.1 any eq domain
 deny   udp host 149.3.140.75 any eq domain
 deny   udp host 149.3.141.229 any eq domain
 deny   udp host 159.253.131.119 any eq domain
 deny   udp host 159.253.149.18 any eq domain
 deny   udp host 173.192.165.151 any eq domain
 deny   udp host 173.244.222.224 any eq domain
 deny   udp host 173.245.61.144 any eq domain
 deny   udp host 174.127.103.199 any eq domain
 deny   udp host 174.127.103.233 any eq domain
 deny   udp host 174.127.73.11 any eq domain
 deny   udp host 174.127.73.144 any eq domain
 deny   udp host 174.127.73.190 any eq domain
 deny   udp host 174.127.73.20 any eq domain
 deny   udp host 174.127.73.206 any eq domain
 deny   udp host 174.127.73.9 any eq domain
 deny   udp host 174.127.92.85 any eq domain
 deny   udp host 174.127.92.91 any eq domain
 deny   udp host 174.127.93.67 any eq domain
 deny   udp host 174.127.97.87 any eq domain
 deny   udp host 174.136.43.89 any eq domain
 deny   udp host 174.36.34.227 any eq domain
 deny   udp host 174.37.211.115 any eq domain
 deny   udp host 176.227.211.178 any eq domain
 deny   udp host 176.31.240.157 any eq domain
 deny   udp host 176.31.247.53 any eq domain
 deny   udp host 176.31.249.65 any eq domain
 deny   udp host 176.9.16.212 any eq domain
 deny   udp host 176.9.63.8 any eq domain
 deny   udp host 178.162.147.191 any eq domain
 deny   udp host 178.238.227.97 any eq domain
 deny   udp host 178.238.230.63 any eq domain
 deny   udp host 178.238.232.202 any eq domain
 deny   udp host 178.33.231.214 any eq domain
 deny   udp host 178.33.231.85 any eq domain
 deny   udp host 184.154.96.26 any eq domain
 deny   udp host 184.172.136.64 any eq domain
 deny   udp host 188.138.88.35 any eq domain
 deny   udp host 188.138.89.234 any eq domain
 deny   udp host 188.165.178.179 any eq domain
 deny   udp host 188.165.178.185 any eq domain
 deny   udp host 188.165.178.186 any eq domain
 deny   udp host 188.165.193.169 any eq domain
 deny   udp host 188.227.184.186 any eq domain
 deny   udp host 188.7.3.219 any eq domain
 deny   udp host 193.36.45.139 any eq domain
 deny   udp host 194.28.158.14 any eq domain
 deny   udp host 194.28.158.142 any eq domain
 deny   udp host 197.1.66.90 any eq domain
 deny   udp host 199.189.107.76 any eq domain
 deny   udp host 199.59.163.250 any eq domain
 deny   udp host 200.98.197.32 any eq domain
 deny   udp host 201.240.58.107 any eq domain
 deny   udp host 204.93.201.127 any eq domain
 deny   udp host 206.217.209.34 any eq domain
 deny   udp host 206.217.220.197 any eq domain
 deny   udp host 206.217.220.209 any eq domain
 deny   udp host 208.43.123.158 any eq domain
 deny   udp host 208.96.34.35 any eq domain
 deny   udp host 209.212.146.30 any eq domain
 deny   udp host 209.59.169.27 any eq domain
 deny   udp host 212.7.194.3 any eq domain
 deny   udp host 213.165.80.141 any eq domain
 deny   udp host 216.121.87.180 any eq domain
 deny   udp host 216.139.213.144 any eq domain
 deny   udp host 216.139.240.37 any eq domain

[savio]

запретил рекурсию. забанил все айпишки которые резолвили ripe.net.
сейчас входящий трафик к ДНС'у упал до 17кбит/с