درخواست کمک برای رفع ابیوز

[behtash007]

سلام خدمت استانید
من سرور میکروتیک دارم که ابیوز ارسال شده به متنش هم به شکل زیر به من مدت کوتای فرصت داده شده تا ابیوز برطرف کنم . چطور میتونم با توجه به متن زیر مشکل ابیوز حل کنم

product:dedicated server - d9-500-92918
ip address:31.3.234.219
you appear to be running an open recursive resolver at ip address 31.3.234.219 that participated in an attack against a customer of ours, generating large udp responses to spoofed queries, with those responses becoming fragmented because of their size.

please consider reconfiguring your resolver in one or more of these ways:

- to only serve your customers and not respond to outside ip addresses (in bind, this is done by defining a limited set of hosts in "allow-query"; with a windows dns server, you would need to use firewall rules to block external access to udp port 53)
- to only serve domains that it is authoritative for (in bind, this is done by defining a limited set of hosts in "allow-query" for the server overall but setting "allow-query" to "any" for each zone)
- to rate-limit responses to individual source ip addresses (such as by using dns response rate limiting or iptables rules)

more information on this type of attack and what each party can do to mitigate it can be found here: http://www.us-cert.gov/ncas/alerts/ta13-088a

if you are an isp, please also look at your network configuration and make sure that you do not allow spoofed traffic (that pretends to be from external ip addresses) to leave the network. Hosts that allow spoofed traffic make possible this type of attack.

example dns responses from your resolver during this attack are given below. 
date/timestamps (far left) are utc.

2016-01-02 21:18:29.200039 ip (tos 0x0, ttl 54, id 43335, offset 0, flags [+], proto udp (17), length 1500) 31.3.234.219.53 > 192.223.24.x.4444: 54336| 22/0/0 cpsc.gov. Rrsig[|domain]
0x0000: 4500 05dc a947 2000 3611 d264 1f03 eadb e....g..6..d....
0x0010: C0df 18a7 0035 115c 1007 56d7 d440 8380 .....5.\..v..@..
0x0020: 0001 0016 0000 0000 0463 7073 6303 676f .........cpsc.go
0x0030: 7600 00ff 0001 c00c 002e 0001 0000 2cb7 v.............,.
0x0040: 011c 000f 0702 0000 5460 5690 788c 5687 ........t`v.x.v.
0x0050: 2ffc /.
2016-01-02 21:18:29.200367 ip (tos 0x0, ttl 54, id 43336, offset 0, flags [+], proto udp (17), length 1500) 31.3.234.219.53 > 192.223.24.x.4444: 54336| 22/0/0 cpsc.gov. Rrsig[|domain]
0x0000: 4500 05dc a948 2000 3611 d263 1f03 eadb e....h..6..c....
0x0010: C0df 18a7 0035 115c 1007 3772 d440 8380 .....5.\..7r.@..
0x0020: 0001 0016 0000 0000 0463 7073 6303 676f .........cpsc.go
0x0030: 7600 00ff 0001 c00c 002e 0001 0000 2cb7 v.............,.
0x0040: 011c 0002 0702 0000 5460 5690 788c 5687 ........t`v.x.v.
0x0050: 2ffc /.
2016-01-02 21:18:29.200755 ip (tos 0x0, ttl 54, id 43337, offset 0, flags [+], proto udp (17), length 1500) 31.3.234.219.53 > 192.223.24.x.4444: 54336| 22/0/0 cpsc.gov. Dnskey[|domain]
0x0000: 4500 05dc a949 2000 3611 d262 1f03 eadb e....i..6..b....
0x0010: C0df 18a7 0035 115c 1007 f92b d440 8380 .....5.\...+.@..
0x0020: 0001 0016 0000 0000 0463 7073 6303 676f .........cpsc.go
0x0030: 7600 00ff 0001 c00c 0030 0001 0000 2cb7 v........0....,.
0x0040: 0108 0100 0307 0301 0001 c38d 6318 badd ............c...
0x0050: F987 ..

(the final octet of our customer's ip address is masked in the above output because some automatic parsers become confused when multiple ip addresses are included. The value of that octet is "167".)

-john
president
nfoservers.com

[j4b3r]

سلام
مشکل open recursive دارید
dns server رو روی مسکروتیک غیر فعال کنید
. یا اینکه کلا پورت ۵۳ رو ببندید روی سرور

- - - Updated - - -

سلام
مشکل open recursive دارید
dns server رو روی مسکروتیک غیر فعال کنید
. یا اینکه کلا پورت ۵۳ رو ببندید روی سرور