Psilo | 20 May 2013 16:23

[opennic-discuss] iptables rules inefficient

Dear OpenNIC,

I have setup my iptables rules according to the wiki but still getting a lot of unwanted traffic with isc.org and ripe.net.
Here is the output of dnstop:

Query Name           Count      %
---------------- --------- ------
ripe.net               590   54.2
isc.org                406   37.3
cnr.it                  13    1.2
akamaiedge.net           6    0.6
140.in-addr.arpa         6    0.6
125.in-addr.arpa         5    0.5
2-0.pl                   5    0.5
86.in-addr.arpa          5    0.5
multi-play.pl            4    0.4
multi-play.eu            4    0.4
net.pl                   4    0.4
202.in-addr.arpa         3    0.3
46.in-addr.arpa          3    0.3
91.in-addr.arpa          3    0.3

I have setup the following iptables rules which were supposed to block this traffic:

# isc.org
-A DNSFILTER -p udp -m string --hex-string "|00000000000103697363036f726700|" --algo bm --dport 53 -j DROP
# ripe.net
-A DNSFILTER -p udp -m string --hex-string "|0000000000010472697065036e6574|" --algo bm --dport 53 -j DROP

The "ddos.pl" script is neither efficient.

I am getting annoyed by my provider who wants to cut the server because of this traffic.

Can you please help me figure what's wrong? Do you have a more aggressive version of this filters?

Thanks
Psilo
Christopher | 12 Jun 2012 04:14
Picon

Re: [opennic-discuss] Codenamed: MUD4TLD

On Mon, Jun 11, 2012 at 2:46 AM, Martin C <martin <at> mchomenet.com> wrote:
>> I wouldn't suggest that you use CGI, though. It's old and slow.
>
> I tried to google this but only found a few references to people talking
> about having to load Perl and it's various modules, ...

From what I've gathered is that there's CGI, then there's Fast CGI.
It's a slightly different standard that reduces overhead. If I recall
correctly, CGI runs the CGI program every time it makes a request.
Fast CGI lets the CGI program keep running (so there's no overhead of
starting/stopping the program constantly) and sends requests through a
socket. I think it also supports things in a more flexible manner, but
I don't know the details off-hand.

--------
You are a member of the OpenNIC Discuss list. 
You may unsubscribe by emailing discuss-unsubscribe <at> lists.opennicproject.org

Quinn Wood | 4 Apr 2012 04:14
Picon

Re: [opennic-discuss] D.N.S. accounts?

On Tue, Apr 3, 2012 at 17:39, Brian Koontz <brian <at> opennicproject.org> wrote:
> Quinn, I wouldn't call such a setup a "walled garden."  That implies
> exclusive membership.  The garden is still open; you just have to open
> the gate yourself.

Ah. That makes more sense.

Mike | 16 Feb 2012 04:14
Favicon
Gravatar

Re: [opennic-discuss] Threat

I think I'd think twice about hitching our wagon to Anonymous. I think
we should milk the situation for all it's worth. But I, for one, would
strongly urge against getting actually associated with Anonymous.

It is very easy to imagine that Anonymous is controlled opposition (i.e.
it has been set up as a controlled bogey man) to 'menace' the Internet
while appealing to the knee jerk reaction to stick it to the man. So
after these attacks, the establishment can say 'look at what happened
here, we need more control over the Internet so this does not happen
again'. In other words, I think Anonymous is being used by the
establishment to set up these 'false flag' attacks so people start
begging for the governments to take more control over the Internet.

If what I've just outlined is true or not, the result will be the same,
the establishment will use it as an excuse to crack down even harder.

I don't think what Anonymous is doing is a very good idea, and I really
don't want to have anything to do with it, or be associated with it in
any way.

--Mike

On 02/15/2012 09:16 PM, Julian DeMarchi wrote:
> 
> How do you make contact with Anonymous? They'd appeal to our cause...
> 
> --julian

Picon
Favicon

Re: [opennic-discuss] OpenNIC web hosting

It is uderstandable why people loose motivation. You put in hard work, 
and none of your friends can see it on OpenNIC namespace! This can 
change, but asking people to use OpenNIC DNS servers. The more who use 
our servers, the more users we have to view content. This is of course 
how ICANN became the defacto. Imagine if OpenNIC T1 servers were 
included in the default bind hints file... This would no longer be the case.

  ---------------

ok, and what about more .tld, there is a list of suggestions, why we 
dont take it back and start moving this..

lets do a big jump. i can setup again my tier2, wich place is better for 
you.  denver, usa. chicago, usa, or czech republic, europe.

alex.

Ing. Alejandro M. Hospedaje Web y Servidores Dedicados 
http://www.dedicados.com.mx ------ correo / msn: ventas <at> dedicados.com.mx 
skype: dedicados

El 06/02/2012 04:46 p.m., Julian DeMarchi escribió:
> On 02/07/2012 05:49 AM, Hospedaje Web y Servidores Dedicados wrote:
>> i dont feel motivated by opennic anymore. but i will continue offering a
>> Tier2 server in places is unavailable to others yet. Im working on
>> putting my t2 back.
> It is uderstandable why people loose motivation. You put in hard work,
> and none of your friends can see it on OpenNIC namespace!
>
> This can change, but asking people to use OpenNIC DNS servers. The more
> who use our servers, the more users we have to view content. This is of
> course how ICANN became the defacto. Imagine if OpenNIC T1 servers were
> included in the default bind hints file... This would no longer be the case.
>
> --julian
> _______________________________________________
> discuss mailing list
> discuss <at> lists.opennicproject.org
> http://lists.darkdna.net/mailman/listinfo/discuss
>
> You may unsubscribe by emailingdiscuss-unsubscribe <at> lists.opennicproject.org.
_______________________________________________
discuss mailing list
discuss <at> lists.opennicproject.org
http://lists.darkdna.net/mailman/listinfo/discuss

You may unsubscribe by emailing discuss-unsubscribe <at> lists.opennicproject.org.

Dale | 5 Feb 2012 19:44

[opennic-discuss] OpenNIC web hosting

Hi Julian,
I recently sent you an e-mail to your jdcomputers address, but not sure if you got it. I'm inquiring about
OpenNIC's web (+ mail) hosting (which I read about in the wiki), since my home web server is too slow to be
useful for my purposes. Is this still continuing, & is it for any OpenNIC TLD? If so, I would like to apply.
E-mail me back at dweide9 <at> netscape.net & I can send the required info. If it is not still available, what
would be the alternative?
Thanks,

Dale
_______________________________________________
discuss mailing list
discuss <at> lists.opennicproject.org
http://lists.darkdna.net/mailman/listinfo/discuss

You may unsubscribe by emailing discuss-unsubscribe <at> lists.opennicproject.org.
Dale | 31 Jan 2012 02:23

[opennic-discuss] Fwd: server setup


Hi all,
Boy, I can see why most people need their website hosted. This DNS crap can drive a person nuts! 
So I updated my ISP with what Amrit & Alex said & below is his response. In my freespeech.free control panel
there is only info regarding name servers, their settings & whether I choose to use my own or opennics, & I
chose opennic's servers. There is no place to put in my static ip address. It sounds like what he is saying,
is that everything needs to be correct & working between opennic's name servers & my computer before an
rDNS will work on his end. Does it sound like I am reading him correctly & if so, is he right?

Dale

-----Original Message-----
From: David T <davidterc <at> napanet.net>
To: 'Dale' <dweide9 <at> aim.com>
Sent: Mon, Jan 30, 2012 9:55 am
Subject: RE: [opennic-discuss] server setup

From what I’m gathering from this, you need to have a domain/subdomain that points back at your static IP,
and once that is in place, I can set the rDNS up with that domain that is properly set, otherwise the system
will not allow it.

-Dave

From: Dale [mailto:dweide9 <at> aim.com] 
Sent: Saturday, January 28, 2012 8:07 PM
To: support <at> napanet.net
Subject: Fwd: [opennic-discuss] server setup

Hi David, 

First I want to say thank you for your patience on this. 

Below is the response I got from Amrit, a knowledgeable gentleman on this subject. He is not aware that I
already have bind9 running on my server, it is set as master of my domain, & it has the appropriate file with a
reverse look up zone & a Pointer Record (PTR), but freespeech.free is still unreachable even with all
this. So please read what he wrote below, but in order for my domain name to work, it appears essential that
Napanet create a PTR. Here is what my file looks like, which I'm assuming is somewhat similar to what you
would need to create (it should have 2 name servers listed but bind threw an error, which resolved when I
removed it):

> ; BIND reverse data file for my local interface
> ;
> $TTL    86400
>  <at>        IN      SOA     ns1.freespeech.free. dweide9.netscape.net. (
>                             2          ; Serial
>                         28800          ; Refresh
>                          7200          ; Retry
>                        604800          ; Expire
>                         86400 )        ; Negative Cache TTL
> ;
>  <at>        IN      NS      ns1.
>  <at>        IN      A       202.83.95.228
> 10    IN    PTR    ns1.freespeech.free.

There is also some info from Alex, below what Amrit sent. I am including it, but to me it just seems to muddy the
water. 

Thanks again for working with me on this, & I owe you a 6-pack (or case?) of the finest beer. Which for you would
be what?

Dale

From: Amrit Panesar <apanesar <at> 4195tech.com>

The way I can see this playing out is like this:

Essentially you need to run a Bind9 server. This DNS server will be 
authoritative (master) for your opennic domain(s). Generally, your ISP is 
supposed to set the Pointer Record (PTR) on their own, any time you need to 
change your rDNS, you're supposed to go through them. However, I think they're 
trying to delegate (using an NS record) the rDNS to the Tier1 server, this is 
not correct. Any Tier1 servers are only authoritative for OpenNIC zones. So, as 
per your rDNS, you either need to make a reverse look up zone with a PTR record 
for your IP OR (in what I believe is the proper way to do this) have your ISP 
set the PTR on their end.
Just to reiterate, even if your ISP doesn't resolve OpenNIC zones (though you 
should definitely urge them to!), they can still set an rDNS for your ip with an
OpenNIC domain.
Good Luck!
--Amrit

 
And this was from Alex:
thats not a rDNS, you cant do: 202.83.95.229 point to 50.0.97.146, thats 
forward.

rDNS is, if you have the ip 202.83.95.229 you can request your reverse 
dns like -> ns.tier2.dale.com and both must be syncronized

ip --> DNS
DNS --> ip

and then do what Amrit said.
On Jan 28, 2012, at 9:20, Dale <dweide9 <at> aim.com> wrote:

> 
> 
> 
> Hi all,
> I'm hoping someone can help me help my ISP. As per earlier directions from 
Amrit, I contacted my ISP & asked them to set up an rDNS for my home webserver. 
Below you'll note that the tech guy requested info for the .free TLD Tier1 
server. I gave this to him but is this the info he really needs? As you can see 
below, he was unable to set up the rDNS for me using that server info. Can 
anyone tell what he was doing wrong? I think Amrit felt this was the issue after 
seeing the nslookup results that are far below. 
> I just switched to a small local ISP, who gave me a static ip & are quite 
willing to help me, so the answer wouldn't be to switch my ISP again.
> 
> 
> Dale
> 
> 
> -----Original Message-----
> From: David T <davidterc <at> napanet.net>
> To: 'Dale' <dweide9 <at> aim.com>
> Sent: Fri, Jan 27, 2012 2:55 pm
> Subject: RE: server setup
> 
> 
> 
> The system won’t allow us to enter this in:
> 
> The name 202.83.95.229 can not be assigned to 50.0.97.146 because 
202.83.95.229 currently points to 202.83.95.229. 202.83.95.229 must point to 
50.0.97.146.
> 
> We don’t have anyone here who would be able to setup something like this for 
you, you would have to look elsewhere unfortunately for guidance on the issue. 
> 
> 
> David Tercovich
> Systems Administrator
> Napanet Internet Services
> 947 Lincoln Ave. Napa, CA 94558
> 707-299-1000 x103 

_______________________________________________
discuss mailing list
discuss <at> lists.opennicproject.org
http://lists.darkdna.net/mailman/listinfo/discuss

You may unsubscribe by emailing discuss-unsubscribe <at> lists.opennicproject.org.
Dale | 28 Jan 2012 18:20

[opennic-discuss] Fwd: server setup


 Hi all,
I'm hoping someone can help me help my ISP. As per earlier directions from Amrit, I contacted my ISP & asked
them to set up an rDNS for my home webserver. Below you'll note that the tech guy requested info for the .free
TLD Tier1 server. I gave this to him but is this the info he really needs? As you can see below, he was unable to
set up the rDNS for me using that server info. Can anyone tell what he was doing wrong? I think Amrit felt this
was the issue after seeing the nslookup results that are far below. 
I just switched to a small local ISP, who gave me a static ip & are quite willing to help me (though they may be
lacking the technical know-how), so the answer wouldn't be to switch my ISP again.

Dale

-----Original Message-----
From: David T <davidterc <at> napanet.net>
To: 'Dale' <dweide9 <at> aim.com>
Sent: Fri, Jan 27, 2012 2:55 pm
Subject: RE: server setup

The system won’t allow us to enter this in:

The name 202.83.95.229 can not be assigned to 50.0.97.146 because 202.83.95.229 currently points to
202.83.95.229. 202.83.95.229 must point to 50.0.97.146.

We don’t have anyone here who would be able to setup something like this for you, you would have to look
elsewhere unfortunately for guidance on the issue. 

 
David Tercovich
Systems Administrator
Napanet Internet Services
947 Lincoln Ave. Napa, CA 94558
707-299-1000 x103

From: Dale [mailto:dweide9 <at> aim.com] 
Sent: Friday, January 27, 2012 12:05 PM
To: davidterc <at> napanet.net
Subject: Re: server setup

Hi David,

If the rDNS needs to be the .free TLD Tier1 server at opennic, then yes that would be correct. 
Is this the missing link that will allow surfers to find my server when they try to go to freespeech.free?
Also, if things are set up properly on your end but people still can't connect to freespeech.free, could I
pay a service fee to have someone troubleshoot my server settings?

Dale

-----Original Message-----
From: David T <davidterc <at> napanet.net>
To: 'Dale' <dweide9 <at> aim.com>
Sent: Fri, Jan 27, 2012 9:38 am
Subject: RE: server setup

So for clarification, you would like me to set your rDNS to 202.83.95.229 correct?

David Tercovich

Systems Administrator

Napanet Internet Services

947 Lincoln Ave. Napa, CA 94558

707-299-1000 x103

From: Dale [mailto:dweide9 <at> aim.com] 
Sent: Thursday, January 19, 2012 3:36 PM
To: support <at> napanet.net
Subject: Fwd: server setup

Tech support,

First I would like to say thanks to the tech support guy who helped me on Tuesday. I think his name was David,
but I owe him a beer anyway. 

Per David's request, this e-mail's purpose is to give you the Tier1 servers for opennic.glue, so that
people trying to reach my home webserver at freespeech.free can find it. Actually I only see one server for
the .free TLD, which is called ns21, is at ip address 202.83.95.229, & the admin is Julian De Marchi. If you
really need a secondary, I would go with server ns5 at 128.177.28.254. (and in case you need it, my static ip
is 50.0.97.146) I got this info from this address: wiki.opennicproject.org/Tier1
Let me know if you need anything else (nslookup & system file info is below),

Dale Weide

# 225-7654

-----Original Message-----
From: Amrit Panesar <apanesar <at> 4195tech.com>
To: discuss <discuss <at> lists.opennicproject.org>
Sent: Mon, Jan 16, 2012 9:34 pm
Subject: Re: [opennic-discuss] server setup

It would appear that your reverse host record is controlled by your ISP. You 
have to ask them to give you a RDNS ((and subsequently a static ip). As for your forward lookup zone, try 
running 'bind-checkzone <zone name> <zone file>' that usually shows any zone 
configuration syntax errors that may be lingering. (also bind-checkconf is also 
a very valuable tool for checking your bind.conf and included files). And if all 
else fails, try enabling logging (specifically all the logging channels, 
including the debug) and see what bind spits out when it starts up

Thanks

--Amrit

Sent from my iPhone

On Jan 16, 2012, at 21:10, Dale <dweide9 <at> aim.com> wrote:

> Thank you for the warm responses about helping. 
> Okay, here we go. As I had mentioned earlier, I can access my web server by ip 
but not name. Below is info from various files. Please let me know what the 
&$ <at> $!#* I'm doing wrong. My server ip address is 50.0.97.146, I'm using a local 
isp but looks like they utilize sonic.net & dsltransport.net If I do nslookup of 
my ip from another computer I get:
> 
> gnomad <at> dales-hp-laptop:~$ nslookup 50.0.97.146
> Server:        74.207.247.4
> Address:    74.207.247.4#53
> 
> Non-authoritative answer:
> 146.97.0.50.in-addr.arpa    name = 50-0-97-146.static.dsltransport.net.
> 
> Authoritative answers can be found from:
> 0.50.in-addr.arpa    nameserver = A.AUTH-NS.SONIC.net.
> 0.50.in-addr.arpa    nameserver = B.AUTH-NS.SONIC.net.
> 0.50.in-addr.arpa    nameserver = C.AUTH-NS.SONIC.net.
> A.AUTH-NS.SONIC.net    internet address = 209.204.159.20
> A.AUTH-NS.SONIC.net    has AAAA address 2001:5a8:0:3::1
> B.AUTH-NS.SONIC.net    internet address = 184.173.92.18
> B.AUTH-NS.SONIC.net    has AAAA address 2607:f0d0:1102:f::2
> C.AUTH-NS.SONIC.net    internet address = 69.9.186.104
> C.AUTH-NS.SONIC.net    has AAAA address 2001:48c8:1:1::2

 

_______________________________________________
discuss mailing list
discuss <at> lists.opennicproject.org
http://lists.darkdna.net/mailman/listinfo/discuss

You may unsubscribe by emailing discuss-unsubscribe <at> lists.opennicproject.org.
Uwe Kiewel | 24 Jan 2012 22:19
Picon

[opennic-discuss] 88.198.249.114 / 2001:6f8:1c30::3

Hi

I will shut down my server for network migration. I will be back in a
couple of days with new ip addresses.

See you soon,
	Uwe
_______________________________________________
discuss mailing list
discuss <at> lists.opennicproject.org
http://lists.darkdna.net/mailman/listinfo/discuss

You may unsubscribe by emailing discuss-unsubscribe <at> lists.opennicproject.org.

Jeff Taylor | 22 Jan 2012 02:27
Favicon

[opennic-discuss] Problems with opennicproject.org/com

There are problems with the nameservers for opennicproject.org that may 
not get fixed this weekend.  I have put a temporary patch in place for 
both the .org and .com domains that should allow those using opennic DNS 
servers to reach the site, but that's as much as I can do from here.

If you are trying to reach the main page, please try both the .org and 
.com domains, and we will get this problem fixed as soon as possible.
_______________________________________________
discuss mailing list
discuss <at> lists.opennicproject.org
http://lists.darkdna.net/mailman/listinfo/discuss

You may unsubscribe by emailing discuss-unsubscribe <at> lists.opennicproject.org.

Mike N. | 8 Jan 2012 13:22
Gravatar

[opennic-discuss] NEW Teir 2 Server tested and ready for listing

Provided by MyOwnSOHO, hosted in Brooklyn, NY

ns1.ns-records.net
74.212.172.171
support <at> myownsoho.net or abuse <at> myownsoho.net or admin <at> ns-records.net

new website for ns-records.com/net to come soon! we will be doing 
maanged DNS services including dynamic DNS!!!!1

:D
thanks guys,

regarding OpenNIC services, Logs are rotated daily and destroyed 
weekly.
---
Mike Nichols
mike <at> myownsoho.net
o. 212 2022194
c. 347 7251661
http://myownsoho.com
_______________________________________________
discuss mailing list
discuss <at> lists.opennicproject.org
http://lists.darkdna.net/mailman/listinfo/discuss

You may unsubscribe by emailing discuss-unsubscribe <at> lists.opennicproject.org.


Gmane