Skip to main content
Super User

Return to Question

grammar corrections, added tag
Source Link
edit approved Jun 23, 2020 at 22:25
auspicious99
edit approved Jun 23, 2020 at 22:25
auspicious99
  • 117
  • 1
  • 10

I mistakenly setup open resolver DNS server, which was soon used for a bunch of DDoS attacks originating somewhere from / to Russia. For that reason I completely blocked port 53 on both DNS servers for everyone except for trusted IP's. It does work, in that I am not able to connect to them anymore, but what seems weird to me is that when I run tcpdump on eth1 (which is interface on server with public Internet) I see lots of incoming packets from attacker to port 53.

Is it normal that tcpdump displaydisplays these packets even if iptables dropdrops them? Or did I configure iptables wrongwrongly?

On other hand I don't see any outgoing packets from my server, which I did before, so I suppose that the firewall is kind of working. It just surprisesurprises me that the kernel doesn't drop packets entirely? Or is tcpdump hooked to the kernel in a way that it sees the packets even before they get to iptables?

I mistakenly setup open resolver DNS server, which was soon used for bunch of DDoS attacks originating somewhere from / to Russia. For that reason I completely blocked port 53 on both DNS servers for everyone except for trusted IP's. It does work, I am not able to connect to them anymore, but what seems weird to me is that when I run tcpdump on eth1 (which is interface on server with public Internet) I see lots of incoming packets from attacker to port 53.

Is it normal that tcpdump display these packets even if iptables drop them? Or did I configure iptables wrong?

On other hand I don't see any outgoing packets from my server, which I did before, so I suppose that firewall is kind of working. It just surprise me that kernel doesn't drop packets entirely? Or is tcpdump hooked to kernel in a way that it sees the packets even before they get to iptables?

I mistakenly setup open resolver DNS server, which was soon used for a bunch of DDoS attacks originating somewhere from / to Russia. For that reason I completely blocked port 53 on both DNS servers for everyone except for trusted IP's. It does work, in that I am not able to connect to them anymore, but what seems weird to me is that when I run tcpdump on eth1 (which is interface on server with public Internet) I see lots of incoming packets from attacker to port 53.

Is it normal that tcpdump displays these packets even if iptables drops them? Or did I configure iptables wrongly?

On other hand I don't see any outgoing packets from my server, which I did before, so I suppose that the firewall is kind of working. It just surprises me that the kernel doesn't drop packets entirely? Or is tcpdump hooked to the kernel in a way that it sees the packets even before they get to iptables?

Tweeted twitter.com/super_user/status/1208130093048049668
added 2 characters in body
Source Link
VL-80
VL-80
  • 4.7k
  • 2
  • 29
  • 40

I mistakenly setup open resolver DNS server, which was soon used for bunch of DDoS attacks originating somewhere from / to russiaRussia. For that reason I completely blocked port 53 on both DNS servers for everyone except for trusted IP's. It does work, I am not able to connect to them anymore, but what seems weird to me is that when I run tcpdump on eth1 eth1 (which is interface on server with public internetInternet) I see lots of incoming packets from attacker to port 53.

Is it normal that tcpdump display these packets even if iptables drop them? Or did I configure iptables wrong?

On other hand I don't see any outgoing packets from my server, which I did before, so I suppose that firewall is kind of working. It just surprise me that kernel doesn't drop packets entirely? Or is tcpdump hooked to kernel in a way that it sees the packets even before they get to iptables?

I mistakenly setup open resolver DNS server, which was soon used for bunch of DDoS attacks originating somewhere from / to russia. For that reason I completely blocked port 53 on both DNS servers for everyone except for trusted IP's. It does work, I am not able to connect to them anymore, but what seems weird to me is that when I run tcpdump on eth1 (which is interface on server with public internet) I see lots of incoming packets from attacker to port 53.

Is it normal that tcpdump display these packets even if iptables drop them? Or did I configure iptables wrong?

On other hand I don't see any outgoing packets from my server, which I did before, so I suppose that firewall is kind of working. It just surprise me that kernel doesn't drop packets entirely? Or is tcpdump hooked to kernel in a way that it sees the packets even before they get to iptables?

I mistakenly setup open resolver DNS server, which was soon used for bunch of DDoS attacks originating somewhere from / to Russia. For that reason I completely blocked port 53 on both DNS servers for everyone except for trusted IP's. It does work, I am not able to connect to them anymore, but what seems weird to me is that when I run tcpdump on eth1 (which is interface on server with public Internet) I see lots of incoming packets from attacker to port 53.

Is it normal that tcpdump display these packets even if iptables drop them? Or did I configure iptables wrong?

On other hand I don't see any outgoing packets from my server, which I did before, so I suppose that firewall is kind of working. It just surprise me that kernel doesn't drop packets entirely? Or is tcpdump hooked to kernel in a way that it sees the packets even before they get to iptables?

Source Link
Petr
Petr
  • 2.4k
  • 6
  • 29
  • 39

Does tcpdump bypass iptables?

I mistakenly setup open resolver DNS server, which was soon used for bunch of DDoS attacks originating somewhere from / to russia. For that reason I completely blocked port 53 on both DNS servers for everyone except for trusted IP's. It does work, I am not able to connect to them anymore, but what seems weird to me is that when I run tcpdump on eth1 (which is interface on server with public internet) I see lots of incoming packets from attacker to port 53.

Is it normal that tcpdump display these packets even if iptables drop them? Or did I configure iptables wrong?

On other hand I don't see any outgoing packets from my server, which I did before, so I suppose that firewall is kind of working. It just surprise me that kernel doesn't drop packets entirely? Or is tcpdump hooked to kernel in a way that it sees the packets even before they get to iptables?