Forum Discussion

Deep_287674's avatar
Deep_287674
Icon for Nimbostratus rankNimbostratus
Oct 06, 2016

iRule for DNS Flood protection

Hi Team, We have implemented new F5 AFM/ASM DDOS boxes. We need to create iRule to protect DNS flood from some range of IP but we need to whitelistdnsdomain.   when DNS_REQUEST {set fqdn [DNS::que...
AFM
iRules
security
  • Migara_61430's avatar
    Migara_61430
    Oct 06, 2016

    You can apply a similar logic

     

    https://devcentral.f5.com/codeshare/http-request-throttle-version-101-and-above

     

Migara_61430's avatar
Migara_61430
Historic F5 Account
Oct 06, 2016

This logic will drop all the DNS queries belongs to a FQDN, unless that FQDN is in your whitelist. If that's what you want to do, yes, this will work.

 

If you want some sort of rate limiting then you will have to implement a logic with a counter and drop packets based on requests per second.