- Program: dnsdist
- Issue type: Feature request
Short description
It would be nice to have an option to have dynblock counters for whole subnets instead of single IP addresses only.
Blocking entire subnets with setMasks already exist, but not counting.
Usecase
A while ago, my DNS servers (running the PowerDNS stack - dnsdist, auth & recursor) were flooded with junk queries for a certain domain with about ~600000 queries per second for about 20 minutes, but handling this without a sweat.
Those queries came from multiple IPs also in the same subnet. Having the ability to count subnets instead of only single IP addresses would allow to create multi-staged dynblocks (lower limits for /32 & /128 and higher limits for /24 & /48 for example) which could make combatting abuse easier.
Description
This could be achieved with two new optional keys for options (for example ipv4Mask and ipv6Mask as key name and an integer as key value) on setRCodeRate, setQTypeRate, setQueryRate (those are the ones I am currently using, please think of all of them where it'd make sense) to configure the netmasks for IPv4 and IPv6 separately.
You could then set for example setRCodeRate without this parameter to count single IPs on a dynblock group, and then specify a new dynblock group with the parameter set (this 2nd dynblock obviously only makes sense with also setMasks being set) and higher limits to count subnets to create as said above multi-staged / multi-layered dynblocks.
Short description
It would be nice to have an option to have dynblock counters for whole subnets instead of single IP addresses only.
Blocking entire subnets with
setMasksalready exist, but not counting.Usecase
A while ago, my DNS servers (running the PowerDNS stack - dnsdist, auth & recursor) were flooded with junk queries for a certain domain with about ~600000 queries per second for about 20 minutes, but handling this without a sweat.
Those queries came from multiple IPs also in the same subnet. Having the ability to count subnets instead of only single IP addresses would allow to create multi-staged dynblocks (lower limits for /32 & /128 and higher limits for /24 & /48 for example) which could make combatting abuse easier.
Description
This could be achieved with two new optional keys for
options(for exampleipv4Maskandipv6Maskas key name and an integer as key value) onsetRCodeRate,setQTypeRate,setQueryRate(those are the ones I am currently using, please think of all of them where it'd make sense) to configure the netmasks for IPv4 and IPv6 separately.You could then set for example
setRCodeRatewithout this parameter to count single IPs on a dynblock group, and then specify a new dynblock group with the parameter set (this 2nd dynblock obviously only makes sense with alsosetMasksbeing set) and higher limits to count subnets to create as said above multi-staged / multi-layered dynblocks.