DNS Tunnel Mitigation v2
Problem this snippet solves: (Solution from Pedro Haoa) Due to some people attempt DNS tunneling to pass data frames inside of DNS records to the Internet and the lack of information around here, I'm going to share with you some basic code for DNS Tunnel Mitigation on the BIG-IPs. This irule put some overhead in your CPU so check it with caution. The idea is to improve this code (I'm looking for less overhead) here in DevCentral and try to build a better base solution for the most common techniques. You can use the DNS Protocol Security, DNS Anti-DDoS and IP Intelligence features to get the most comprehensive solution. Remember that there are a lot of DNS Tunneling utilities with a wide range of capabilities and options, so this is one of many forms to mitigate some of the attacks. How to use this snippet: LTM + AFM + DNS Services BIG-IP AFM (Protocol Security) In Security ›› Protocol Security : Security Profiles : DNS ›› Create a New Security Profile and exclude obsolete record types like MD, MF, MAILA, NULL, HINFO, SPF, etc. Then apply to your DNS profile associated with your Listener. BIG-IP DNS (LTM Data Groups and iRule) Creating DNS Tunnel Query type Data Group BIG-IP AFM (Protocol Security) In Security ›› Protocol Security : Security Profiles : DNS ›› Create a New Security Profile and exclude obsolete record types like MD, MF, MAILA, NULL, HINFO, SPF, etc. Then apply to your DNS profile associated with your Listener. BIG-IP DNS (LTM Data Groups and iRule) Creating DNS Tunnel Query type Data Group create ltm data-group internal TunnelType records replace-all-with { CNAME { } } type string modify ltm data-group internal TunnelType records add { TXT { } } modify ltm data-group internal TunnelType records add { SRV { } } modify ltm data-group internal TunnelType records add { KEY { } } Creating Whitelist Data Group create ltm data-group internal Dominios_Lista_Blanca records replace-all-with { facebook.com { data facebook.com } } type string modify ltm data-group internal Dominios_Lista_Blanca records add { instagram.com { data instagram.com } } modify ltm data-group internal Dominios_Lista_Blanca records add { fbcdn.net { data fbcdn.net } } modify ltm data-group internal Dominios_Lista_Blanca records add { google.com { data google.com } } modify ltm data-group internal Dominios_Lista_Blanca records add { googleapis.com { data googleapis.com } } Creating Blacklist Data Group create ltm data-group internal Dominios_Lista_Negra records replace-all-with { dnstunnel.de { data dnstunnel.de } } type string modify ltm data-group internal Dominios_Lista_Negra records add { cutheatergroup.cn { data cutheatergroup.cn } } modify ltm data-group internal Dominios_Lista_Negra records add { demodomain.cz { data demodomain.cz } } modify ltm data-group internal Dominios_Lista_Negra records add { buo.cc { data buo.cc } } modify ltm data-group internal Dominios_Lista_Negra records add { pdk.lcn.cc { data pdk.lcn.cc } } Code : when RULE_INIT { # Max DNS queries during detection period per source IP / destination domain set static::maxq 180 # Detection & Blocking Period set static::btime 60 } when DNS_REQUEST { set srcip [IP::remote_addr] set qtype [DNS::question type] set DomOrigen [domain [DNS::question name] 4] set key "$srcip:$DomOrigen" if { ([class match $qtype equals TunnelType]) and [DNS::len] > 512 } { if {[class match $DomOrigen ends_with Dominios_Lista_Blanca] }{ return } elseif {[class match $DomOrigen ends_with Dominios_Lista_Negra] }{ DNS::drop return } elseif {[table lookup $key] ne ""} { set count [table incr $key] if {$count > $static::maxq} { DNS::drop return } } else { table add $key 1 indef $static::btime } } } Tested this on version: No Version Found
DNS tunneling mitigation v2 iRule lost - where is it?
In the old Devcentral there was an enhanced & more complex iRule to protect against DNS Tunneling. Old link was https://devcentral.f5.com/questions/dns-tunneling-mitigation with iRule v2. I cannot find it anymore after the Devcentral upgrade. Has anyone a copy of the iRule or working link?DNS Tunnel Mitigation v1
Problem this snippet solves: (Solution from Pedro Haoa) Due to some people attempt DNS tunneling to pass data frames inside of DNS records to the Internet and the lack of information around here, I'm going to share with you some basic code for DNS Tunnel Mitigation on the BIG-IPs. This irule put some overhead in your CPU so check it with caution. The idea is to improve this code (I'm looking for less overhead) here in DevCentral and try to build a better base solution for the most common techniques. You can use the DNS Protocol Security, DNS Anti-DDoS and IP Intelligence features to get the most comprehensive solution. Remember that there are a lot of DNS Tunneling utilities with a wide range of capabilities and options, so this is one of many forms to mitigate some of the attacks. How to use this snippet: LTM + DNS services license Code : # DNS Tunnel Mitigation v1.1 # #Esta iRule analiza cada consulta DNS, intentando identificar rastros comunes de un túnel vía el protocolo DNS. #El mecanismo primario a utilizar son listas (Blancas y Negras). #El mecanismo secundario es analizar la cantidad de consultas DNS idénticas desde una direccion IP específica hacia un dominio específico. #por Pedro Haoa # #Evento inicial que establece variables globales estadísticas, para todas las consultas y conexiones cliente. when RULE_INIT { set static::ataque 0 set static::IP set static::key set static::query } when DNS_REQUEST { #Número máximo de consultas DNS idénticas set max_identical_queries 60 set DomBlack [domain [DNS::question name] 2] set static::query $DomBlack set static::IP [IP::remote_addr] set static::key "$static::IP-$static::query" #log local2. "Consulta desde $static::IP" if {[class match $DomBlack equals blacklist] }{ #log local2. "Dominio $DomBlack bloqueado" DNS::drop return } elseif {[table lookup $static::key] != ""} { #log local2.alert "Alerta Amarilla: Consultas identicas desde $static::IP." set count [table incr $static::key] #log local2.alert "El numero de consultas identicas desde $static::IP es $count" if {$count > $max_identical_queries} { #log local2.alert "Alerta Roja: Demasiadas consultas identicas desde $static::IP" set static::ataque 1 DNS::drop return } } else { #Se crea una entrada en la tabla log local2.alert "Primera consulta desde $static::IP, $static::key" set static::key "$static::IP-$static::query" #Tabla para cada entrada IP-Dominio con expiracion para cada entrada en 60 segundos table set $static::key 1 indefinite 60 } } Tested this on version: No Version Found
