From: Mark Wooding <mdw@distorted.org.uk>
Date: Thu, 23 Jul 2009 11:24:08 +0000 (+0100)
Subject: vampire.m4: Log messages when rejecting DNS DDOS packets.
X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~mdw/git/firewall/commitdiff_plain/2dc8f4afde72f1fc1ea3f64135b36af9ee42e3e9?ds=sidebyside

vampire.m4: Log messages when rejecting DNS DDOS packets.
---

diff --git a/vampire.m4 b/vampire.m4
index 3a389ca..05a3293 100644
--- a/vampire.m4
+++ b/vampire.m4
@@ -36,10 +36,15 @@ m4_divert(-1)
 ###--------------------------------------------------------------------------
 ### vampire-specific rules.
 
+m4_divert(35)m4_dnl
+errorchain ddos-evil-dns DROP
+## Invalid DNS request with probably-forged sender address, with intent to
+## cause DDOS.
+
 m4_divert(82)m4_dnl
 ## Repelling evil DDos attack.
 run ipset -N ddos-evil-dns iphash 2>/dev/null || :
-run iptables -A inbound -j DROP \
+run iptables -A inbound -g ddos-evil-dns \
 	-m set --set ddos-evil-dns src \
 	-p udp --destination-port $port_dns