Adguard - DNS Amplification Issues - HELP ( SOS )

deepak_leb

Dear Les-bians,

Greeting, Hope Everyone is safe and sound in good shape.
\

Well, Recently I installed a Adguard + Wireguard on a VPS Server. To my suprise am getting New Spam Clients from China and Some other Countries.

Especaillay pizzaseo .com& other clients.

So, kindly say how to stop these, and let me get to know that what i have messed up.

Mr_Tom

@Freek may be able to help?

youandri

How it works?

Email address get from whois domain?

_MS_

@youandri said:
How it works?

Email address get from whois domain?

Not Spam emails but Spam clients.
Client(s) who got the IP Address of new DNS server and started using it for DDoS.

yoursunny

Disable DNS over UDP.
Enable DNS over TLS.
No amplification attack possible.

jnraptor

You mean AdGuard home right? The below works if you are only using AdGuard home to serve your VPS and WireGuard clients.

Under Settings | DNS settings, scroll down to the Access Control fields at the bottom. Under allowed clients, enter in ip ranges to whitelist. For example, I have whitelisted my VPS and wireguard clients in the 10.9.0.0/24 range.
127.0.0.1
10.9.0.0/24

AaronSS

@Freek is the DNS Master

isunbejo

Acl local private ip only

deepak_leb

MS said:

@youandri said:
How it works?

Email address get from whois domain?

Not Spam emails but Spam clients.
Client(s) who got the IP Address of new DNS server and started using it for DDoS.

@yoursunny said:
Disable DNS over UDP.
Enable DNS over TLS.
No amplification attack possible.

Could you elaborate & PM me ?

deepak_leb

@isunbejo said:
Acl local private ip only

Need some detailed description, since am not much into these things

deepak_leb

@StuderSolutions said:
@Freek is the DNS Master

Will contact him

deepak_leb

@Mr_Tom said:
@Freek may be able to help?

Thank you. Will get back to him

deepak_leb

@jnraptor said:
You mean AdGuard home right? The below works if you are only using AdGuard home to serve your VPS and WireGuard clients.

Under Settings | DNS settings, scroll down to the Access Control fields at the bottom. Under allowed clients, enter in ip ranges to whitelist. For example, I have whitelisted my VPS and wireguard clients in the 10.9.0.0/24 range.
127.0.0.1
10.9.0.0/24

Let me check on to it & pm you

Freek

@StuderSolutions said:
@Freek is the DNS Master

@Mr_Tom said:
@Freek may be able to help?

Thanks for the mention

@yoursunny said:
Disable DNS over UDP.
Enable DNS over TLS.
No amplification attack possible.

This will indeed fix your problems, @deepak_leb .But if you absolutely must DNS over UDP, you can try the following:

• Setup a rate limit in Adguard (Settings --> DNS Settings). 100 is a reasonable rate limit.
• Disable ANY queries. ANY queries have no valid reason to exist anymore and are mainly used by DNS amplification attacks (https://blog.cloudflare.com/rfc8482-saying-goodbye-to-any/). In you AdGuardHome.yml set refuse_any: true
• Whitelist only your IP address using either UFW/Iptables or in Adguard itself (Settings --> Allowed Clients). If your IP is dynamic, then you need to work with a blocklist. This is a good one to start with: https://github.com/DandelionSprout/adfilt/blob/master/AdGuardHomeDisallowedIPs.txt

But I do wonder; is AdGuard listening on the correct interface? Since it shouldn't be listening on your public IP if you use WireGuard to connect...

kuduku

@Freek said:

@StuderSolutions said:
@Freek is the DNS Master

@Mr_Tom said:
@Freek may be able to help?

Thanks for the mention

@yoursunny said:
Disable DNS over UDP.
Enable DNS over TLS.
No amplification attack possible.

This will indeed fix your problems, @deepak_leb .But if you absolutely must DNS over UDP, you can try the following:

• Setup a rate limit in Adguard (Settings --> DNS Settings). 100 is a reasonable rate limit.
• Disable ANY queries. ANY queries have no valid reason to exist anymore and are mainly used by DNS amplification attacks (https://blog.cloudflare.com/rfc8482-saying-goodbye-to-any/). In you AdGuardHome.yml set refuse_any: true
• Whitelist only your IP address using either UFW/Iptables or in Adguard itself (Settings --> Allowed Clients). If your IP is dynamic, then you need to work with a blocklist. This is a good one to start with: https://github.com/DandelionSprout/adfilt/blob/master/AdGuardHomeDisallowedIPs.txt

But I do wonder; is AdGuard listening on the correct interface? Since it shouldn't be listening on your public IP if you use WireGuard to connect...

Yes you might be 100% correct as probably in listening interface all interfaces were selected instead of only wireguard interface . Saw the same issue when i did this exact mistake . Once Wireguard interface is selected their are no unknown clients

deepak_leb

@kuduku said:

@Freek said:

@StuderSolutions said:
@Freek is the DNS Master

@Mr_Tom said:
@Freek may be able to help?

Thanks for the mention

@yoursunny said:
Disable DNS over UDP.
Enable DNS over TLS.
No amplification attack possible.

This will indeed fix your problems, @deepak_leb .But if you absolutely must DNS over UDP, you can try the following:

• Setup a rate limit in Adguard (Settings --> DNS Settings). 100 is a reasonable rate limit.
• Disable ANY queries. ANY queries have no valid reason to exist anymore and are mainly used by DNS amplification attacks (https://blog.cloudflare.com/rfc8482-saying-goodbye-to-any/). In you AdGuardHome.yml set refuse_any: true
• Whitelist only your IP address using either UFW/Iptables or in Adguard itself (Settings --> Allowed Clients). If your IP is dynamic, then you need to work with a blocklist. This is a good one to start with: https://github.com/DandelionSprout/adfilt/blob/master/AdGuardHomeDisallowedIPs.txt

But I do wonder; is AdGuard listening on the correct interface? Since it shouldn't be listening on your public IP if you use WireGuard to connect...

Yes you might be 100% correct as probably in listening interface all interfaces were selected instead of only wireguard interface . Saw the same issue when i did this exact mistake . Once Wireguard interface is selected their are no unknown clients

I only selected eth0 Wireguard interface alone

kuduku

@deepak_leb said:

@kuduku said:

@Freek said:

@StuderSolutions said:
@Freek is the DNS Master

@Mr_Tom said:
@Freek may be able to help?

Thanks for the mention

@yoursunny said:
Disable DNS over UDP.
Enable DNS over TLS.
No amplification attack possible.

This will indeed fix your problems, @deepak_leb .But if you absolutely must DNS over UDP, you can try the following:

• Setup a rate limit in Adguard (Settings --> DNS Settings). 100 is a reasonable rate limit.
• Disable ANY queries. ANY queries have no valid reason to exist anymore and are mainly used by DNS amplification attacks (https://blog.cloudflare.com/rfc8482-saying-goodbye-to-any/). In you AdGuardHome.yml set refuse_any: true
• Whitelist only your IP address using either UFW/Iptables or in Adguard itself (Settings --> Allowed Clients). If your IP is dynamic, then you need to work with a blocklist. This is a good one to start with: https://github.com/DandelionSprout/adfilt/blob/master/AdGuardHomeDisallowedIPs.txt

But I do wonder; is AdGuard listening on the correct interface? Since it shouldn't be listening on your public IP if you use WireGuard to connect...

Yes you might be 100% correct as probably in listening interface all interfaces were selected instead of only wireguard interface . Saw the same issue when i did this exact mistake . Once Wireguard interface is selected their are no unknown clients

I only selected eth0 Wireguard interface alone

eth0 should be the NIC and wg0 as wireguard interface or whatever name was given for listening interface

deepak_leb

@kuduku said:

@deepak_leb said:

@kuduku said:

@Freek said:

@StuderSolutions said:
@Freek is the DNS Master

@Mr_Tom said:
@Freek may be able to help?

Thanks for the mention

@yoursunny said:
Disable DNS over UDP.
Enable DNS over TLS.
No amplification attack possible.

This will indeed fix your problems, @deepak_leb .But if you absolutely must DNS over UDP, you can try the following:

• Setup a rate limit in Adguard (Settings --> DNS Settings). 100 is a reasonable rate limit.
• Disable ANY queries. ANY queries have no valid reason to exist anymore and are mainly used by DNS amplification attacks (https://blog.cloudflare.com/rfc8482-saying-goodbye-to-any/). In you AdGuardHome.yml set refuse_any: true
• Whitelist only your IP address using either UFW/Iptables or in Adguard itself (Settings --> Allowed Clients). If your IP is dynamic, then you need to work with a blocklist. This is a good one to start with: https://github.com/DandelionSprout/adfilt/blob/master/AdGuardHomeDisallowedIPs.txt

But I do wonder; is AdGuard listening on the correct interface? Since it shouldn't be listening on your public IP if you use WireGuard to connect...

Yes you might be 100% correct as probably in listening interface all interfaces were selected instead of only wireguard interface . Saw the same issue when i did this exact mistake . Once Wireguard interface is selected their are no unknown clients

I only selected eth0 Wireguard interface alone

eth0 should be the NIC and wg0 as wireguard interface or whatever name was given for listening interface

Any guides pls

kuduku

@deepak_leb said:

@kuduku said:

@deepak_leb said:

@kuduku said:

@Freek said:

@StuderSolutions said:
@Freek is the DNS Master

@Mr_Tom said:
@Freek may be able to help?

Thanks for the mention

@yoursunny said:
Disable DNS over UDP.
Enable DNS over TLS.
No amplification attack possible.

This will indeed fix your problems, @deepak_leb .But if you absolutely must DNS over UDP, you can try the following:

• Setup a rate limit in Adguard (Settings --> DNS Settings). 100 is a reasonable rate limit.
• Disable ANY queries. ANY queries have no valid reason to exist anymore and are mainly used by DNS amplification attacks (https://blog.cloudflare.com/rfc8482-saying-goodbye-to-any/). In you AdGuardHome.yml set refuse_any: true
• Whitelist only your IP address using either UFW/Iptables or in Adguard itself (Settings --> Allowed Clients). If your IP is dynamic, then you need to work with a blocklist. This is a good one to start with: https://github.com/DandelionSprout/adfilt/blob/master/AdGuardHomeDisallowedIPs.txt

But I do wonder; is AdGuard listening on the correct interface? Since it shouldn't be listening on your public IP if you use WireGuard to connect...

Yes you might be 100% correct as probably in listening interface all interfaces were selected instead of only wireguard interface . Saw the same issue when i did this exact mistake . Once Wireguard interface is selected their are no unknown clients

I only selected eth0 Wireguard interface alone

eth0 should be the NIC and wg0 as wireguard interface or whatever name was given for listening interface

Any guides pls

No guide required . Just select wg0 in listen interface when you setup Adguard

elliotc

Add the domain in disallowed domains and limit the rate limit for example 3 per second

deepak_leb

@kuduku said:

@deepak_leb said:

@kuduku said:

@deepak_leb said:

@kuduku said:

@Freek said:

@StuderSolutions said:
@Freek is the DNS Master

@Mr_Tom said:
@Freek may be able to help?

Thanks for the mention

@yoursunny said:
Disable DNS over UDP.
Enable DNS over TLS.
No amplification attack possible.

This will indeed fix your problems, @deepak_leb .But if you absolutely must DNS over UDP, you can try the following:

• Setup a rate limit in Adguard (Settings --> DNS Settings). 100 is a reasonable rate limit.
• Disable ANY queries. ANY queries have no valid reason to exist anymore and are mainly used by DNS amplification attacks (https://blog.cloudflare.com/rfc8482-saying-goodbye-to-any/). In you AdGuardHome.yml set refuse_any: true
• Whitelist only your IP address using either UFW/Iptables or in Adguard itself (Settings --> Allowed Clients). If your IP is dynamic, then you need to work with a blocklist. This is a good one to start with: https://github.com/DandelionSprout/adfilt/blob/master/AdGuardHomeDisallowedIPs.txt

But I do wonder; is AdGuard listening on the correct interface? Since it shouldn't be listening on your public IP if you use WireGuard to connect...

Yes you might be 100% correct as probably in listening interface all interfaces were selected instead of only wireguard interface . Saw the same issue when i did this exact mistake . Once Wireguard interface is selected their are no unknown clients

I only selected eth0 Wireguard interface alone

eth0 should be the NIC and wg0 as wireguard interface or whatever name was given for listening interface

Any guides pls

No guide required . Just select wg0 in listen interface when you setup Adguard

But I couldnt get the wg0. On interfaces, am getting only eth0 and l0 interfaces

kuduku

Whats is your wireguard interface ? Select that interface on Adguard setup page , listen interface

deepak_leb

@kuduku said:
Whats is your wireguard interface ? Select that interface on Adguard setup page , listen interface

Will pm u

kuduku

ok .

NanoG6

Or maybe you can stop setting up your own DNS server and use 94.140.14.14 / 94.140.15.15 instead

deepak_leb

Everything has been sorted out. Thank all for your time 🙂

_MS_

@deepak_leb said:
Everything has been sorted out. Thank all for your time 🙂

Write a tutorial for LES blog .

Freek

@deepak_leb said:
Everything has been sorted out. Thank all for your time 🙂

Please share how you solved your issue. Like I told you via PM; a forum is to share knowledge, not to keep it secret in private messages.

deepak_leb

@Freek said:

@deepak_leb said:
Everything has been sorted out. Thank all for your time 🙂

Please share how you solved your issue. Like I told you via PM; a forum is to share knowledge, not to keep it secret in private messages.

🥺 Nothing special, Before Installating the wireguard, I simply installed the Adguard, that's in DNS Interface I haven't got the wireguard WgO interface.

Besides I followed the NAT Vps Guide blindly though I don't use that NAT VPS

vimalware

So I guess OP replicated the setup I use.

1) have the adguard/pihole/ANY_dnsserver listen exclusively on wg0 (wireguard nic)
2) use wireguard tunnel for all internet traffic and the private wg0 ip for dns-nameserver value .

The dns bots will move on.

deepak_leb

@vimalware said:
So I guess OP replicated the setup I use.

1) have the adguard/pihole/ANY_dnsserver listen exclusively on wg0 (wireguard nic)
2) use wireguard tunnel for all internet traffic and the private wg0 ip for dns-nameserver value .

The dns bots will move on.

@vimalware said:
So I guess OP replicated the setup I use.

1) have the adguard/pihole/ANY_dnsserver listen exclusively on wg0 (wireguard nic)
2) use wireguard tunnel for all internet traffic and the private wg0 ip for dns-nameserver value .

The dns bots will move on.

Yep

dankkster

Am I reading this right that you can set up wireguard to filter all DNS queries from adguardhome? I know you can use wireguard to browse and whatever using adguard recursively with argo tunnel. If it is possible to point adguard at a wiregaurd network, I would love to know how. Many thanks!

Encoders

@dankkster said:
Am I reading this right that you can set up wireguard to filter all DNS queries from adguardhome? I know you can use wireguard to browse and whatever using adguard recursively with argo tunnel. If it is possible to point adguard at a wiregaurd network, I would love to know how. Many thanks!

1. install wireguard, use Nyr/wireguard-install, write down your host IP (like 10.7.0.1)
2. install adguard, make sure to listen at there -> 10.7.0.1
3. change your wireguard conf file to use DNS at 10.7.0.1

your config file will looks like this

[Interface]
Address = 10.7.0.X/24
DNS = 10.7.0.1
PrivateKey = key

[Peer]
PublicKey = pubkey
PresharedKey = key
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = {Server IP}:{Listening port}
PersistentKeepalive = 25

this way, as long as wireguard is connected, it'll tell the connection to send dns request to 10.7.0.1, or where your adguard installation at

Encoders

speaking of amplification this just hapens to me recently

surprised this doesn't mentioned in first page
https://github.com/AdguardTeam/AdGuardHome/wiki/Configuration

Anti-DNS amplification features
ratelimit — DDoS protection, specifies in how many packets per second a client should receive. Anything above that is silently dropped. To disable set 0, default is 20. Safe to disable if DNS server is not available from internet.
ratelimit_whitelist — If you want exclude some IP addresses from ratelimiting but keep ratelimiting on for others, put them here.

dankkster

@Encoders said:
this way, as long as wireguard is connected, it'll tell the connection to send dns request to 10.7.0.1, or where your adguard installation at

Perfect! I already had wireguard installed and I checked that it is indeed with the script from Nyr. So it looks like a simple matter of changing the config file to the proper dns IP. And I guess making wireguard run as a service?

Also I have it set up recursive, so adguard is pointing to 127.0.0.1 currently.

127.0.0.1:5335 127.0.0.1:5053 127.0.0.1:8053

The wg0.conf interface address is already 10.7.0.1/24. So I also add the interface DNS address as 10.7.0.1? Here is my current config. I may need to redo. Just let me know.

`# Do not alter the commented lines

They are used by wireguard-install

ENDPOINT - WAN-IP

[Interface]
Address = 10.7.0.1/24
PrivateKey = Private Key
ListenPort = Port

BEGIN_PEER

[Peer]
PublicKey = Public Key
PresharedKey = Preshared Key
AllowedIPs = 10.7.0.2/32

END_PEER`

Lastly - Would using cloudflared with this hinder/help? I have a guide that I used to get recursive DNS going with adguardhome/unbound/stubby with cloudflared. The wireguard install was also part of the guide, but did not (to my knowledge) include having queries sent through it.

dankkster

ran out of time to edit and fix the large font - apologies

Encoders

@dankkster said: So it looks like a simple matter of changing the config file to the proper dns IP. And I guess making wireguard run as a service?

iirc by using the install script, your wireguard server is run as service by default

@dankkster said: The wg0.conf interface address is already 10.7.0.1/24. So I also add the interface DNS address as 10.7.0.1?

yeah like that. inside AdGuardHome.yaml you'll see the bind_host config, make sure your 10.7.0.1 is at there so AdGuard will also listen into DNS traffic at there

dns:
  bind_hosts:
    - 10.7.0.1
    - some other IP

@dankkster said: Here is my current config. I may need to redo. Just let me know.

You don't change the wireguard server config at all. in fact, don't change it lol. what you need to modify is the installer script itself

In this line wireguard-install.sh#L102

Change that to "AdGuard Self-Host" or something

then in this line wireguard-install.sh#L134

change

dns="94.140.14.14, 94.140.15.15"

to

dns="10.7.0.1"

so the next time you re-run to add the new client, you'll automatically get DNS with 10.7.0.1 by using option 6 that you just modify

dankkster

awesome. I will do that asap!

in your opinion, would using cloudflared with this hinder/help? I have a guide that I used to get recursive DNS going with adguardhome/unbound/stubby with cloudflared. The wireguard install was also part of the guide, but did not (to my knowledge) include having queries sent through it.

Just want to know if I need to nix the CF tunnel since I will basically be using... a tunnel lol

Encoders

@dankkster said:
awesome. I will do that asap!

in your opinion, would using cloudflared with this hinder/help? I have a guide that I used to get recursive DNS going with adguardhome/unbound/stubby with cloudflared. The wireguard install was also part of the guide, but did not (to my knowledge) include having queries sent through it.

Just want to know if I need to nix the CF tunnel since I will basically be using... a tunnel lol

cloudflared probably only useful to manage the web access. IIRC from the documentation cloudflare only proxy traffic that comes to port 80 or 443, never heard / read documentation about it where they also accept DNS/port53 traffic

dankkster

@Encoders said:
cloudflared probably only useful to manage the web access. IIRC from the documentation cloudflare only proxy traffic that comes to port 80 or 443, never heard / read documentation about it where they also accept DNS/port53 traffic

Ok, thanks. I have removed the tunnel for now and will try the wireguard option again. It did not work last try.