Running a public name server on the Internet today can be challenging with the never-ending flood of attacks against it. The situation only gets worse if you're an ISP providing recursive lookups for customers.
Some customer hosts become compromised and are used to send spam, which in turn sends thousands of DNS requests per minute to your name server as they seek recipients' mail server addresses. Other hosts resolve web or mail logs for envelope verification, causing bursts of DNS requests. The result is often an overworked public name server that cannot reliably answer requests for non-abusive hosts.
There are many solutions — more servers, specialized hardware, or firewalls. Another option, if you're running your name server on Linux with nftables, is PHREL.
PHREL is a Per Host RatE Limiter written in C to track incoming traffic per host and insert rules into a dedicated nftables table when a threshold is crossed. Rules may rate-limit or block the offending host until traffic returns to normal. It is particularly well suited to protecting name servers from flood traffic and preventing SSH brute-force attempts.
Install PHREL on the name server using the install instructions, or grab packages from the downloads page.
Command-line example
Once installed, configure thresholds via the command line or /etc/phrel/phreld.conf. For this article we'll use the command line.
Track UDP port 53 with a 50 PPS threshold rate-limited to 25 PPS, and a 150 PPS threshold that blocks completely:
# /usr/sbin/phreld -P udp -p 53 -T50:25 -T150:0
Exclude trusted networks with -X. The host running phreld is excluded automatically:
# /usr/sbin/phreld -P udp -p 53 -T50:25 -T150:0 -X 39.250.66.0/24 -X 23.120.42.2
Configuration file
The same thresholds in the v2.0+ brace-block syntax:
phrel {
protocol udp;
port 53;
threshold pps 50 rate 25;
threshold pps 150 rate 0;
exclude [ 39.250.66.0/24 23.120.42.2 ];
}
When phreld starts with no command-line options, it reads /etc/phrel/phreld.conf automatically.
Multiple name servers behind a load balancer can synchronize per-host statistics with Redis — see phreld.conf(5) for the redis { } block.
Actions are logged to syslog. See the man page for more options. Questions and bug reports: sella@digitalgenesis.com.