DynBlockRulesGroup blocking subnet dnsdist 1.9.8 alpine

[rishu007]

• This is not a support question, I have read about opensource and will send support questions to the IRC channel, GitHub Discussions or the mailing list.
• I have read and understood the 'out in the open' support policy

• Program: dnsdist
• Issue type: Bug report

Short description

Environment

• Operating system: alpine linux
• Software version: dnstdist version 1.9.8
• Software source:

Steps to reproduce

1. craate dynamicRuleGroup and BPFFilter
2. generate traffic from private ips

Expected behaviour

my expectation dynamic block should only block those ips which are seding more queries then the rate limit instead blocking the entier subnet which will not allow other ips to send queries

Actual behaviour

queries from other ips which are not hitting the ratelimit is getting blocked because of subnet block by dyamic block group

Other information

[omoerbeek]

Please show your full config and other relevant info. I'm moving this to a discussion as there is no evidence yet it is actually a bug.

[rishu007]

bpf = newBPFFilter({ipv4MaxItems=1024, ipv6MaxItems=1024, qnamesMaxItems=1024})
setDefaultBPFFilter(bpf)
local dbr = dynBlockRulesGroup()
dbr:setQueryRate(20, 10, "Exceeded query rate", 60)
function maintenance()
dbr:apply()
end

this is the simpled configuration i have used it does blocking the attacker ip but also the entier subnet and because of it ohter private ip queries are not processed

[rgacogne]

What makes you think that the entire subnet is blocked by DNSdist? The showDynBlocks() says otherwise, unless I'm missing something.

[rishu007]

dbr:includeRange("10.224.0.5/32")
dbr:includeRange("10.224.0.4/32")

You are not blocking these IPs, you are telling dnsdist that only these IPs can be blocked.

you mean to say i have to apply rate limiting with that to block these two ips

[rgacogne]

[1746783229.139300280] Packet from 10.224.0.5:48227 for inadAy1638478479.EdGE-dEv.tEaMpLaY.test-ttes.cOm. CNAME with id 37914

for security reason i have hide our domain name but this is a sample of log

This is what LogAction is logging, but if you are running in verbose mode and without the setDefaultBPFFilter(bpf) you should be getting a lot more lines about your queries.
Please also note that you removing parts of the log makes it hard for us to understand what is going on, and therefore reduce the time we are willing to spend on this.

[rishu007]

i noticed my all the logs have two ips which are not the client ips can you help me with configuration so that topClients() give me the original client ips
belwo is my setup
aksloadblancerpublic ip-> dnsdist pod in aks-> pdnsserverpublicip->pdnspod
logs 12:11:48.560233 IP 10.244.1.41.53 > 10.224.0.4.49162: 60593*- 1/0/1 CNAME uniform120sbcdnceshk. (126)
as you can see this sort of mapping happening that's the reason i am only getting two ips because i have only configured two ips of pdns servers in my dnsdist pod. can you please help with some configuaration that i can do so that orignal client ip can be sent to pdns server and ratelimiting will also work. Currenlty ratlimit blocks these two ips and hence everything gets blocked because of ip forwarding.

[rishu007]

when i changed my aks loadbalncer config extranaltraffic policy to Local which gives me the client ips that i can see in tcp dump but post that dnsdist not forwards requests to pdns server and server status is geting down

[rishu007]

we were able to do it thanks for the support