Limit response rate to defense DDoS

[kenshinx]

Use limit_req, limit_conn, limit_rate similar as Nginx used to defend againt DDoS attack.
Especially the DNS Refelection Attack & DNS Amplification Attack that is being rampant recently.

[robcza]

I think, the situation here is a bit different to nginx, as there is the reason to rate limit to protect the application itself. On DNS resolver the reason is not to be abused during a DoS by a spoofed requests.

Following materials could come in handy:

• http://www.redbarn.org/dns/ratelimits
• http://ss.vix.su/~vixie/isc-tn-2012-1.txt
• http://www.enog.org/presentations/enog-7/267-Farsight_-_A_watchful_eye_on_DNS.pdf
  • "RRL Limits the number of unique responses returned by a DNS server per eg IPv4 /24, or IPv6 /48", seems to be a nice approach

This would be a great and helpful feature for godns, 👍

[kenshinx]

I have not yet deep thinking the implementation of how to defend DoS attack in godns.
Obviously, you have mentioned the right direction.
I modified the title from Limit request rate defense DDoS to Limit response rate to defense DDoS maybe is more correctly. :)

[robcza]

Just trying to bring in some inspiration :) PowerDNS has some DoS aware load-balancer, which could be a nice source of information too.
http://dnsdist.org/