Geo. wrote: >> We have done just this (block inbound udp/53) to certain subnets due to a >> rash of CPEs that happily proxy DNS, including recursive queries, >> from their WAN side. > > What devices? Is this a default or something customers are configuring? Just about every Siemens/Efficient *DSL router (5851, 5871, 5890, some others) I have seen does this by default. During one attack I logged into a router and changed the DNS servers used for DHCP from both, to one, to the other, and watched its traffic flow exactly where I pointed the DNS servers. These routers also have a bad habit of hijacking DNS requests for anything in the form of <routername>.anydomain.com. Even if the DNS request is sent to an ISP name server, it will still return a record pointing to its own LAN IP when queried for, i.e. foo.bork.com and foo.microsoft.com if you named the router "foo". It's not only done by default, it's not a configurable behavior as far as I've been able to find. The fix we were supplied with was to block inbound udp/53 using the router's internal IP filtering, and to name the router something unique (i.e. a customer's order number). Jim
