Stopping Open DNS - Billion: Difference between revisions
m (AA-Andrew moved page Fixing Open DNS - Billion to Stopping Open DNS - Billion) |
mNo edit summary |
||
| (One intermediate revision by the same user not shown) | |||
| Line 6: | Line 6: | ||
[[File:Billion_dns_filter1.jpg|400px]] |
[[File:Billion_dns_filter1.jpg|400px]] |
||
*Then re-test from the Control Pages: https://clueless.aa.net.uk/dnsresolvers.cgi |
|||
Please note that on these routers this does not prevent the router's internal resolver from doing the DNS lookup itself. This isn't usually a problem, but due to recent DNS amplification attacks sometimes lookups have continued after fixing the original problem. To prevent this add a rule blocking DNS *from* the router's WAN IP *to* port 53. This will prevent usage of the router as the LAN's DNS resolver. |
Please note that on these routers this does not prevent the router's internal resolver from doing the DNS lookup itself. This isn't usually a problem, but due to recent DNS amplification attacks sometimes lookups have continued after fixing the original problem. To prevent this add a rule blocking DNS *from* the router's WAN IP *to* port 53. This will prevent usage of the router as the LAN's DNS resolver. |
||
[[Category:Open DNS Resolvers]] |
[[Category:Open DNS Resolvers]] |
||
[[Category: |
[[Category:3rd Party Routers]] |
||
Latest revision as of 09:22, 25 February 2015
Billion
Billion routers appear to have a built-in DNS resolver, and answer queries on the WAN interface by default, so is vulnerable to taking part in DDoS attacks by replying to spoofed dns queries. Screenshot below shows how to block this in filters.
This was tested on Firmware Version : 2.7.0.23(UE0.C2C)3.5.10.1
- Then re-test from the Control Pages: https://clueless.aa.net.uk/dnsresolvers.cgi
Please note that on these routers this does not prevent the router's internal resolver from doing the DNS lookup itself. This isn't usually a problem, but due to recent DNS amplification attacks sometimes lookups have continued after fixing the original problem. To prevent this add a rule blocking DNS *from* the router's WAN IP *to* port 53. This will prevent usage of the router as the LAN's DNS resolver.