75
edits
This is the support site for Andrews & Arnold Ltd, a UK Internet provider. Information on these pages is generally for our customers but may be useful to others, enjoy!
m (update clueless to control) |
|||
(37 intermediate revisions by 3 users not shown) | |||
==What is an
Every day,
AAISP customers normally use the AAISP DNS servers, or often their own router.
It is quite common for DSL routers to respond to these DNS requests on the WAN side as well as the LAN - this means that other people on the Internet can use your router to do their DNS
The 'attack' in this sense is more about attacking somebody else on the Internet
<center>
{| class="wikitable"
!colspan="2"|DNS
|-
|[[File:Opendns1.png|300px|DNS attack]]
|[[File:Opendns2.png|300px|Multiple attacks bring the victim down]]
|-
!Single attack to a victim
!By using multiple open servers, the attacker can bring the victim down by flooding it with traffic.
|}
</center>
In the past having an open resolver on a router wasn't a problem, and there are many many routers which leave DNS open in their default state
This is often referred to as a 'DNS
==What if I run a DNS server on purpose?==
It is quite legitimate for people to run DNS servers on their
If you run
▲It is quite legitimate for people to run DNS servers on their Network - in these cases access to them should be restricted or limited.
If you run
You can disable our automatic scanning, see [[#Disabling Automatic Scans]] below.
▲If you run a Caching resolver, configure it to only return records for your users (firewall to only allow your users).
=How to
In short, a router with DNS open on the WAN side should have
See the pages below for details on specific routers
=Automatic and Manual Testing for Open Resolvers=
There is a page on the AAISP control pages that lists your IPs that have an open DNS server running, and can also re-scan your IP blocks (IPv4). AAISP will re-scan automatically every so often and will alert customers by email if an open DNS resolver is found. Sorry, but we don't have enough time to scan IPv6 addresses.
Log in to the [https://control.aa.net.uk/ Control Pages], and then either click on one of your IPv4 addresses or a broadband line. On these pages you'll see a link to the open DNS page.
==Disabling Automatic Scans==
[[Category:Router]]▼
On a per IP block basis you can disable our regular scans. From the Control Pages, click on the IP block and change the setting.
[[File:DNS-Check-flag.png|border]]
You will still be able to run the checks manually.
[[Category:Routers]]
[[Category:Diagnostic Tools]]
|
edits