[SOLVED] Roku DNS storm is impacting OPNsense

[keeka]

@OPNenthu Dealing with the problem before the queries hit a DNS server is the favourite solution IMO. Thanks for posting (post #25).

[tangofan]

I'm going to call this a win.  Been following the issue for some days now and the pf rate limiter is reliably capping the queries from the Roku group to just around 300/min, which corresponds perfectly to the 50 / 10s rate that I set in the rules.

That "50 per 10s" you set, is this per individual device (e.g. per source ip) or is this across all matches for that rule (so the matches for Roku1 would also count towards the rate limiting of Roku2 and vice versa)?

[OPNenthu]

That "50 per 10s" you set, is this per individual device (e.g. per source ip) or is this across all matches for that rule (so the matches for Roku1 would also count towards the rate limiting of Roku2 and vice versa)?

Going off of the man page description for 'max-pkt-rate', I think it should count for all the clients in the source alias I used.  The manual says it measures "packets matching the rule and states created by it," which I interpret this way.

I can say that the earlier Unbound reports corroborated this.  While both of the Rokus were actively spamming, the total rate of queries between them was capped at the set rate.

Maybe a dev can confirm this.

[OPNenthu]

Oh, but I think there might be a wrinkle with how the floating rules expand.  One rule in OPNsense could really be several rules in pf, so best to check the ruleset on the backend.