Category:Open DNS Resolvers: Difference between revisions

==What is an Openopen DNS Resolverresolver?==

Every day, all theeach time we all use DNS to look up names and IPs on the Internet - ie,e.g. when you put bbc.co.uk in your browser, your computer needs to look up the IP address of the BBC's web server. To do this it will use DNS. The DNS server will respond back to your computer with the information.

It is quite common for DSL routers to respond to these DNS requests on the WAN side as well as the LAN - this means that other people on the Internet can use your router to do their DNS look upslookups. It also means that 'attackers' can take advantage of this and use your router to attack someone else. This will use up bandwidth on your line.

The 'attack' in this sense is more about attacking somebody else on the Internet by using your DNS resolver. What happens, is that an attacker sends a DNS request to your router from a spoofed IP address. This spoofed IP address is the IP that the attacker wants to target, the victim. Your router then replies to the spoofed IP address with the DNS result. The DNS reply is larger in size tothan the request, and thus this is an 'amplification' attack. On its own one router won't make a difference, but when the same amplification attack is applied to many routers the aggregate reply traffic can become quite disruptive to the victim!.

{| class="mw-collapsible mw-collapsed wikitable"

!colspan="2"|DNS Amplificationamplification Attackattack Diagramsdiagrams

In the past having an open resolver on a router wasn't a problem, and there are many many routers which leave DNS open in their default state,. howeverHowever, this has been exploited and so it is best to disable this feature on routers.

This is often referred to as a 'DNS Amplificationamplification Attacksattack'.

If you run ana Authoritativecaching DNS serverresolver, configure it only to only return records for your domainusers (firewall to only allow your users), and consider implementing rate-limiting.

=How to Fixprevent Routersthis?=

In short, a router with DNS open on the WAN side should have it'sits DNS service disabled or fire-walled. (port 53 to the Routerrouter should be blocked)