DNS & NTP UDP Amplification Attack Defense with iptables

Mitigate massive reflection attacks (NTP, DNS, Memcached) that saturate network interfaces with unsolicited large UDP reply payloads.

1. Attack Signature & Impact Analysis

Critical (Bandwidth Saturation)

Attackers send tiny queries with spoofed victim source IP to misconfigured open resolvers, which reflect responses up to 50x to 500x larger directly to the victim server.

2. Production Hardening Configuration (`/etc/iptables/udp-defense.sh`)

Deploy this validated configuration to your production server or reverse proxy:

# 1. Drop UDP packets under 64 bytes (common anomaly indicators)
iptables -A INPUT -p udp -m length --length 0:64 -j DROP

# 2. Limit incoming DNS (53) and NTP (123) query reflections
iptables -A INPUT -p udp --sport 53 -m hashlimit --hashlimit-above 50/sec \
  --hashlimit-burst 100 --hashlimit-mode dstip --hashlimit-name dns_reflect -j DROP

iptables -A INPUT -p udp --sport 123 -m hashlimit --hashlimit-above 10/sec \
  --hashlimit-burst 20 --hashlimit-mode dstip --hashlimit-name ntp_reflect -j DROP

# 3. Block ancient vulnerable Memcached reflection port completely
iptables -A INPUT -p udp --sport 11211 -j DROP

3. Live Simulation & Rule Verification Command

Execute these commands to verify that traffic is actively mitigated without service downtime:

# Check real-time UDP packet drop statistics
iptables -nvL INPUT | grep udp
# Monitor interface traffic volume
sar -n DEV 1 5

4. Common Misconfigurations & Troubleshooting Gotchas

⚠️ Production Caution: If your server is itself an authoritative DNS server, do not drop port 53 indiscriminately. Use response rate limiting (RRL) in BIND/PowerDNS instead.

5. Best Paired With (Complementary Defense Recipes)

Security engineers implementing this rule frequently deploy these complementary baselines: