Deny query from a single IP

[Jeff Lightner]

That being said you CAN do what you asked:

Create an ACL in named.conf:

# Blackhats ACL - zones to be used in blackhole statement - will prevent

# them from being allowed to query and will not respond to them.
acl "blackhats" {
        xx.xx.xx.xx;
};

(Where you put the specific IP in place of the xx.xx.xx.xx.)

Then in options section add a line to use the ACL:
        blackhole { blackhats; };

-----Original Message-----
From: bind-users-bounces at lists.isc.org
[mailto:bind-users-bounces at lists.isc.org] On Behalf Of Eric C. Davis
Sent: Thursday, February 26, 2009 11:24 AM
To: prana9533 at yahoo.com
Cc: bind-users at lists.isc.org
Subject: Re: Deny query from a single IP

It is better do this with a real IPS rather than use your DNS server to 
do this.  You should avoid having any unwanted traffic hit you DNS 
servers ever.

Eric
Prabhat Rana wrote:
> Hello,
> I have BIND 9.5running on a Solaris10 box. It provides recursive DNS
service. I'm trying to implement a script where it reads the BIND stats
file for all the incoming queries and if there are too many queries from
a single user (source IP) it will block queries from that particular IP.
In order for this to occur is there a parameter similar to allow-query
that I can inject into the named.conf to block query from a single IP
address when this condition occurs? Basically I'm trying to add a tool
to detect potential DOS attacks where we see too many queries from one
single IP. Any other suggestions would also be appreciated.
>
> Thanks
> Prabhat.
>
>
>
>
>
>
>       
>
> _______________________________________________
> bind-users mailing list
> bind-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users
>   

_______________________________________________
bind-users mailing list
bind-users at lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
 
Please consider our environment before printing this e-mail or attachments.
----------------------------------
CONFIDENTIALITY NOTICE: This e-mail may contain privileged or confidential information and is for the sole use of the intended recipient(s). If you are not the intended recipient, any disclosure, copying, distribution, or use of the contents of this information is prohibited and may be unlawful. If you have received this electronic transmission in error, please reply immediately to the sender that you have received the message in error, and delete it. Thank you.
----------------------------------