From 3e4e0946835e0ca9b9167b38ac17949754a0f120 Mon Sep 17 00:00:00 2001 From: Martin Zobel-Helas Date: Thu, 9 May 2013 21:23:17 +0200 Subject: [PATCH] add an anti-ddos rule Signed-off-by: Martin Zobel-Helas --- modules/named/manifests/init.pp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/named/manifests/init.pp b/modules/named/manifests/init.pp index 1ce12c907..a2dde9d3c 100644 --- a/modules/named/manifests/init.pp +++ b/modules/named/manifests/init.pp @@ -16,6 +16,12 @@ class named { ensure => running, } + @ferm::rule { 'dsa-bind-no-ddos-any': + domain => '(ip ip6)', + description => 'Allow nameserver access', + rule => 'proto udp dport 53 mod string from 32 to 64 algo bm hex-string \'|0000ff0001|\' jump DROP' + } + @ferm::rule { 'dsa-bind': domain => '(ip ip6)', description => 'Allow nameserver access', -- 2.20.1