Duvida no caso de ataque (Open recursive resolver used for an attack)

Boa Noite a todos
Venho aqui com uma questão que para mim é meio complicada.
Recebi um e-mail hoje pela manha segue abaixo.
Não consegui entender o que fazer.
Bloqueando as portas citadas resolve ?
Alguma Regra no MK que possa resolver ?
Como localizar o cliente que fez o ataque ?
estou usando uma RB Mikrotik na 6.3x autenticação PPPoE.

Desde já agradeço a todos pela atenção e compreensão
Obrigado.




Prezado cliente JAMERSON

Segundo a notificação abaixo do NFOservers, teu IP 200.1xx.xx.xx participou de ataque DoS. Favor verificar tua rede e tomar as devidas correções.


Qualquer dúvida estamos à disposição.


-------- Mensagem encaminhada --------

Assunto:	Open recursive resolver used for an attack: 200.152.69.87
Data:	Mon, 7 Dec 2015 20:23:00 -0800
De:	NFOservers.com DDoS notifier <[email protected]>

You appear to be running an open recursive resolver at IP address 200.152.69.87 that participated in an attack against a customer of ours, generating large UDP responses to spoofed queries, with those responses becoming fragmented because of their size.Please consider reconfiguring your resolver in one or more of these ways:- To only serve your customers and not respond to outside IP addresses (in BIND, this is done by defining a limited set of hosts in "allow-query"; with a Windows DNS server, you would need to use firewall rules to block external access to UDP port 53)- To only serve domains that it is authoritative for (in BIND, this is done by defining a limited set of hosts in "allow-query" for the server overall but setting "allow-query" to "any" for each zone)- To rate-limit responses to individual source IP addresses (such as by using DNS Response Rate Limiting or iptables rules)More information on this type of attack and what each party can do to mitigate it can be found here: http://www.us-cert.gov/ncas/alerts/TA13-088AIf you are an ISP, please also look at your network configuration and make sure that you do not allow spoofed traffic (that pretends to be from external IP addresses) to leave the network. Hosts that allow spoofed traffic make possible this type of attack.Example DNS responses from your resolver during this attack are given below. Date/timestamps (far left) are UTC.2015-12-08 04:17:53.117828 IP (tos 0x0, ttl 46, id 59658, offset 0, flags [+], proto UDP (17), length 1476) 200.152.69.87.53 > 70.42.74.x.4444: 45778| 22/0/0 cpsc.gov. RRSIG[|domain] 0x0000: 4500 05c4 e90a 2000 2e11 dfc7 c898 4557 E.............EW 0x0010: 462a 4a3d 0035 115c 1007 a43a b2d2 8380 F*J=.5.\...:.... 0x0020: 0001 0016 0000 0000 0463 7073 6303 676f .........cpsc.go 0x0030: 7600 00ff 0001 c00c 002e 0001 0000 0832 v..............2 0x0040: 011c 0010 0702 0000 5460 566e 3191 5664 ........T`Vn1.Vd 0x0050: e901 ..2015-12-08 04:17:53.120891 IP (tos 0x0, ttl 46, id 59659, offset 0, flags [+], proto UDP (17), length 1476) 200.152.69.87.53 > 70.42.74.x.4444: 45778| 22/0/0 cpsc.gov. RRSIG[|domain] 0x0000: 4500 05c4 e90b 2000 2e11 dfc6 c898 4557 E.............EW 0x0010: 462a 4a3d 0035 115c 1007 9dbc b2d2 8380 F*J=.5.\........ 0x0020: 0001 0016 0000 0000 0463 7073 6303 676f .........cpsc.go 0x0030: 7600 00ff 0001 c00c 002e 0001 0000 0832 v..............2 0x0040: 011c 000f 0702 0000 5460 566e 3191 5664 ........T`Vn1.Vd 0x0050: e901 ..2015-12-08 04:17:53.123945 IP (tos 0x0, ttl 46, id 59660, offset 0, flags [+], proto UDP (17), length 1476) 200.152.69.87.53 > 70.42.74.x.4444: 45778| 22/0/0 cpsc.gov. RRSIG[|domain] 0x0000: 4500 05c4 e90c 2000 2e11 dfc5 c898 4557 E.............EW 0x0010: 462a 4a3d 0035 115c 1007 f8dc b2d2 8380 F*J=.5.\........ 0x0020: 0001 0016 0000 0000 0463 7073 6303 676f .........cpsc.go 0x0030: 7600 00ff 0001 c00c 002e 0001 0000 0832 v..............2 0x0040: 011c 0002 0702 0000 5460 566e 3191 5664 ........T`Vn1.Vd 0x0050: e901 ..(The final octet of our customer's IP address is masked in the above output because some automatic parsers become confused when multiple IP addresses are included. The value of that octet is "61".)-JohnPresidentNFOservers.com(We're sending out so many of these notices, and seeing so many auto-responses, that we can't go through this email inbox effectively. If you have follow-up questions, please contact us at [email protected].)

DROP na pota 53 amigo, Resolve seu problema.

Citação:

---

Postado originalmente por wdnc5

DROP na pota 53 amigo, Resolve seu problema.

---

Obrigado pela atenção caro colega
Desculpa minha ignorância.
O que seria DROP na porta.

amigo boa noite drop na porta 53 é bloquear ela no servidor

Você vai criar uma Regra de Bloqueio UDP na porta 53 (53 DNS)
e desmaca a opção allow Remote Reguest Do mikrotik se tiver marcada

segue um exemplor de proteção para aplicar no firewall:

/ip firewall filter
add chain=forward dst-address=x.x.x.x/x dst-port=53 protocol=udp \
src-address=x.x.x.x/x

add action=drop chain=forward dst-address=x.x.x.x/x dst-port=53 \
in-interface=interface link protocol=udp


onde x é a ranger de seus clientes.