Public DNS server with gui
Public DNS server with gui
I am looking to setup a public DNS server and I found this DNS server
Does anyone know what the risks are of exposing the DNS port to the internet? How likely am I to get compromised? Is this a really bad idea?
You're viewing a single thread.
Be sure not to create an open resolver, something commonly used in DDoS attacks. https://serverfault.com/questions/573465/what-is-an-open-dns-resolver-and-how-can-i-protect-my-server-from-being-misused#573471
This right here. As a member of the OpenNIC project, I used to run an open resolver and this required a lot of hands-on maintenance. Basically what happens is someone sends a very small packet requesting the lookup of something which returns a huge amount of data (like DNSSEC records). They can make thousands of these requests in a short period, attempting to flood out the target domain's DNS servers and effectively take them offline, by using your open server as the attacker.
At the very least, you need to have strict rate-limiting controls on DNS lookups. And since the requests come in through UDP, they can spoof their IP address so you can't simply block an attacker. When I ran into this issue, I wrote up scripts to monitor for a lot of requests to the same domain name and outright block those until the attack stopped. It wasn't a great solution, but it did at least make sure my system wasn't contributing to an attack.
Your best bet is to only respond to DNS requests for your own domain(s). If you really want an open resolver, think about limiting it by creating some sort of sign-up method (for instance, ddns servers use a specific URL to register the changing IP of known users), but still keep the rate-limiting in place.