Dear, my router OS generate ghost traffic from my users! I changed the DNS for my DNS servers, but the traffic is yet, theys generate traffic to googles DNS and my DNS servers. I'll like anybody help me about this?
Router OS version: 6.44.3
Hardware: CCR1009-7G-1C-1S+
Thankyou
-
-
gladstonreis
just joined
- Posts: 17
- Joined:
DNS ghost traffic
You do not have the required permissions to view the files attached to this post.
Re: DNS ghost traffic
The usrrs are free to use a different DNS and Android and APP want to use the DNS of Google itself.
You can stop that by blocking that traffic to what I call Rouge DNS servers by putting them in a addresslist and drop that traffic.
You can choose to put a NAT enforcer to lesd that trafgic to your own DNS server.
I am not that nice and drop those request by putting them on the addresslist.
You can stop that by blocking that traffic to what I call Rouge DNS servers by putting them in a addresslist and drop that traffic.
You can choose to put a NAT enforcer to lesd that trafgic to your own DNS server.
I am not that nice and drop those request by putting them on the addresslist.
Re: DNS ghost traffic
Also for security issues you need to disable DNS remote request, because your router will respond to requests from WAN! Just with a small command somebody can send you syn requests to porte 53 of your router and within 2 minutes your router will get 100% of processor usage!
Re: DNS ghost traffic
Also for security issues you need to disable DNS remote request, because your router will respond to requests from WAN!
Not necessarily. "DNS remote requests" are needed if router is to be DNS server for LAN devices. DNS service will, by default, answer to requests regardless of their origin (LAN or WAN) and thus comes the threat @ingdaka is mentioning. To avoid that, one should use firewall rule which drops any WAN requests to DNS port. Either a general "drop all from WAN" rule or (less recommended) "drop DNS from WAN" rule such as the following pair (one needs both!)
Code: Select all
/ip firewall filter
add chain=input action=drop protocol=tcp port=53 comment="drop TCP DNS requests from WAN" in-interface-list=WAN
add chain=input action=drop protocol=udp port=53 comment="drop UDP DNS requests from WAN" in-interface-list=WAN
Re: DNS ghost traffic
Devices like Chromecast would then stop work. So I do redirect all DNS to my DNS server.I am not that nice and drop those request by putting them on the addresslist.