Hacker News Reader

dnsmasq has been installed as a local DNS cache on Ubuntu and other Debian derivatives for many years. /etc/resolv.conf normally points at localhost.

View on HN

It only listens on localhost though (127.0.1.1 by default), so it's not possible for it to be abused for dns amplification attacks.

IIRC dnsmasq still listens on all interfaces for some reason

Which is exactly the issue I mentioned.

You get on some distros by default something that that makes you subject to DNS amplification attacks.

It is supposed to reject requests from the addresses it does not listen on. I just found it strange that it binds on all interfaces regardless.

I’ve noticed it respond with an error packet – which ended up being used for DNS Amplification nonetheless.

I thought DNS was connectionless? Don't all DNS clients have to bind to UDP port 53 to function correctly?

It's not the port that matters; it's the interface. A caching DNS service for a simple desktop experience should only be listening for queries on the localhost interface (lo).

Reply on news.ycombinator.com