Bad DNS Query

[12azb]

Hello there, I am having infinite messages on my gateway router and the connection mill totally slow down. Would you please help?

The following are part of the messages displaying on the router.

Nov 22 06:59:02.846: %DNSSERVER-3-BADQUERY: Bad DNS query from 42.3.151.198
Nov 22 06:59:02.974: %DNSSERVER-3-BADQUERY: Bad DNS query from 111.193.196.204
Nov 22 06:59:06.146: %DNSSERVER-3-BADQUERY: Bad DNS query from 219.106.240.238
Nov 22 06:59:06.294: %DNSSERVER-3-BADQUERY: Bad DNS query from 145.255.176.101

[ghostinthenet · Accepted solution]

It looks like you have a DNS server on your router and it's being bombarded with requests from the outside world. If you have no need for the router to be a DNS server, turn it of with the "no ip dns server" configuration command. If you need internal DNS to be served by the router, but have no requirement to provide DNS to the Internet, I would deny DNS requests on the inbound ACL of your Internet-facing interfaces. If, for whatever reason, you do have such a requirement, I would set up control-plane policing to ensure that your router isn't being overloaded.

[12azb]

Thank you very much for your reply. Now I have removed dns service from my router and shifted to an other windows server. But would you please give me hint how I can deny DNS requests on the inbound ACL?

Regards

[ghostinthenet · Accepted solution]

Sure. On the inbound ACL, you can add two lines like this:

deny tcp any any eq 53
deny udp any any eq 53

As long as you're not actually hosting a DNS server that needs to be reachable from the Internet, that will do.