Iptables Drop DNS Damion resolving

NewLegend · 05-08-2014, 08:54 AM

Quote:

Originally Posted by voleg

Check my memoFencing DNS attack with bind9, syslog-ng and iptables

Thanks for your update, but what I looking now is different totally.

Just I looking on any way to convert domain-string to hex.

Thanks ,,,,

gknetw · 05-09-2014, 05:43 AM

Quote:

iptables --insert INPUT -p udp --dport 53 -m string --from 34 --to 80 --algo bm --hex-string '|696e6e6f76616465782e636f6d|' -j DROP -m comment --comment "DROP DNS Q innovadex.com"

--from 34 to 80 has 46 bytes comparison but your string has only 13 byte data, can you change the --from to values and check.

In the meantime post "packet capture" along with ip tables rule you used for filtering.

-Ganesh