Skip to content

Classic dynamic rules

To keep the configuration as simple as possible, Defender provides the ability to set all the dynamic rules supported by DNSdist from the Defender configuration file.

QType rate

This module implements DNSdist's DynBlockRulesGroup:setQTypeRate().

---
- type: qtype-rate
  qtype: AAAA
  rate: 2
  seconds: 2
  comment: "QType rate exceeded"
  action: refused
  action_duration: 60

Please refer to the QType Rate reference for the complete description of the settings.

Query rate

This module implements DNSdist's DynBlockRulesGroup:setQueryRate().

---
- type: query-rate
  rate: 2
  seconds: 2
  comment: "Query rate exceeded"
  action: refused
  action_duration: 60

Please refer to the Query Rate reference for the complete description of the settings.

RCode rate

This module implements DNSdist's DynBlockRulesGroup:setRCodeRate().

---
- type: rcode-rate
  rcode: ServFail
  rate: 2
  seconds: 2
  comment: "Too many ServFails"
  action: drop
  action_duration: 60

Please refer to the RCode Rate reference for the complete description of the settings.

RCode ratio

This module implements DNSdist's DynBlockRulesGroup:setRCodeRatio().

---
- type: rcode-ratio
  rcode: ServFail
  ratio: 0.5
  seconds: 2
  comment: "ServFail ratio is too high"
  action: truncate
  action_duration: 60
  minimum_number_of_responses: 10

Please refer to the RCode Ratio reference for the complete description of the settings.

Using tags to defer processing to regular rules

Defender >= 1.2 used with DNSdist >= 2.1.0 has the ability to defer the decision applied to a query to the regular rules system. The way it works is that the dynamic rule, including PRSD detection, only sets a tag to a specified value, and the presence and value of this tag can later be used in regular rules to determine if the query triggered a dynamic rule, and combine that knowledge with all the existing selectors, that are not available when the dynamic rule is executed, to take an informed decision.

For example the following configuration is setting a tag named defender-qtype-rate when a query has been determined to be over the 2 AAAA queries per second threshold:

---
- type: qtype-rate
  qtype: AAAA
  rate: 2
  seconds: 2
  comment: "QType rate exceeded"
  action_duration: 60
  action: set-tag
  tag_name: "defender-qtype-rate"

The tag can later be used in regular rules to let incoming queries that have been received over DNS over QUIC go, while sending a REFUSED responses to queries that have been received over all the other protocols:

addAction(AndRule({TagRule("defender-query-rate", "1"), NotRule(IncomingProtocolRule("DoQ"))}), RCodeAction(DNSRCode.REFUSED))

Note that the tag value is tested against 1 in this example, which is the default value when unset. We could also set the tag value to something else, like "block me":

---
- type: qtype-rate
  qtype: AAAA
  rate: 2
  seconds: 2
  comment: "QType rate exceeded"
  action_duration: 60
  action: set-tag
  tag_name: "defender-qtype-rate"
  tag_value: "block me"

On the other hand we can also simply test for the tag existence in regular rules, and not bother with the exact value:

addAction(AndRule({TagRule("defender-query-rate"), NotRule(IncomingProtocolRule("DoQ"))}), RCodeAction(DNSRCode.REFUSED))