Category:Open DNS Resolvers: Difference between revisions
No edit summary |
|||
Line 1: | Line 1: | ||
<div class="toccolours mw-collapsible mw-collapsed" style="width:800px"> |
<div class="toccolours mw-collapsible mw-collapsed" style="width:800px"> |
||
=What is an Open DNS Resolver?=<div class="mw-collapsible-content"> |
=What is an Open DNS Resolver?=<div class="mw-collapsible-content"> |
||
Every day, all the time we all use DNS to look up names and IPs on the Internet - ie, when you put bbc.co.uk in your browser, your computer needs to look up the IP address of the BBC's web server. To do this it will use DNS. The DNS server will respond back to your computer with the information. |
Every day, all the time we all use DNS to look up names and IPs on the Internet - ie, when you put bbc.co.uk in your browser, your computer needs to look up the IP address of the BBC's web server. To do this it will use DNS. The DNS server will respond back to your computer with the information. |
||
Revision as of 11:51, 18 Haziran 2013
Every day, all the time we all use DNS to look up names and IPs on the Internet - ie, when you put bbc.co.uk in your browser, your computer needs to look up the IP address of the BBC's web server. To do this it will use DNS. The DNS server will respond back to your computer with the information.
AAISP customers normally use the AAISP DNS servers, or often their own router.
It is quite common for DSL routers to respond to these DNS requests on the WAN side as well as the LAN - this means that other people on the Internet can use your router to do their DNS look ups. It also means that 'attackers' can take advantage of this and use your router to attack someone else. This will use up bandwidth on your line.
In the past having an open resolver on a router wasn't a problem, and there are many many routers which leave DNS open in their default state, however, this has been exploited and so it is best to disable this feature on routers.
This is often referred to as 'DNS Amplification Attacks'.
What if I run DNS servers on purpose?
It is quite legitimate for people to run DNS servers on their Network - in these cases, then access to them should be restricted or limited.
If you run an Authoritative DNS server, configure it only to return records for your domain.
If you run a Caching resolver, configure it to only return records for your users (firewall to only allow your users).
How to Fix Routers?
In short, a router with DNS open on the WAN side should have it's DNS service disabled or fire-walled. (port 53 to the Router should be blocked)
See the pages below for details on specific routers
Pages in category 'Open DNS Resolvers'
The following 8 pages are in this category, out of 8 total.