Netfilter extension to match various DNS atributes

by Ondřej Caletka, 2013

This work is based on the original xt_dns netfilter extension, written by Bartłomiej Korupczyński http://software.klolik.org/xt_dns/

This fork addes availability to match queries, or responses, to match query type (eg. ANY) in queries or even in responses and also to match packet with EDNS0 pseudo-RR and with specific bufsize range. The matching algorithm is fully RFC 1035 compliant.

Only non-fragmented UDP packets are supported, both IPv4 and IPv6.

Usage

See iptables -m dns --help:

dns match options:
[!] --dns-query        match DNS query
[!] --dns-response     match DNS response
[!] --query-type {A|NS|CNAME|SOA|PTR|MX|TXT|AAAA|SRV|A6|ANY|0-255}
                       match specific query type
[!] --edns0            match packets with EDNS0 field
    --bufsize value[:value] match EDNS0 buffer size

Example usage

Classifying ANY-type DNS queries (massively abused for DNS Amplification attacks) and applying a very strict request rate limit:

# iptables -A INPUT -p udp --dport 53 -m dns --dns-query --query-type ANY -m hashlimit --hashlimit-above 10/min --hashlimit-burst 3 --hashlimit-mode srcip --hashlimit-name DNS-ANY -j DROP