Blocking DNS amplification attacks on ipv6 with iptables

Question

I'm running a small Pi-Hole DNS server on my VPS, and I have the following iptables rules enabled to stop the DNS ANY amplification attack:

*raw
-A PREROUTING -p udp --dport 53 -m string --from 40 --algo bm --hex-string "|0000FF0001|" -m recent --name dnsanyquery --rcheck --seconds 60 --hitcount 1 -j DROP
-A PREROUTING -p tcp --dport 53 -m string --from 52 --algo bm --hex-string "|0000FF0001|" -m recent --name dnsanyquery --rcheck --seconds 60 --hitcount 1 -j DROP
COMMIT

(source: https://freek.ws/2017/03/18/blocking-dns-amplification-attacks-using-iptables/)

These two rules work great on ipv4 (I have been under constant attack for weeks now, but all requests are getting blocked), but I've just realized that I don't have an ipv6 equivalent for them, and I don't know if the hex string is compatible, or what the offset would be. I haven't been targeted on ipv6 yet, but I'd rather be ready in advance - especially since my ipv6 address has picked up a couple of port scanners already.

What are the ipv6 equivalent rules to block DNS ANY requests?

Answer 1

The rule for IPv6 should be the same except for the --from argument value.

Since the IP and UDP headers are larger in IPv6 (due to the longer addresses), the DNS section starts later.

According to the UDP wikipedia page, the DNS section offset is 48 bytes, so for UDP you should use --from 48 in your iptables rules.

-A PREROUTING -p udp --dport 53 -m string --from 48 --algo bm --hex-string "|0000FF0001|" -m recent --name dnsanyquery --rcheck --seconds 60 --hitcount 1 -j DROP

For TCP you should check for a similar offset, but I'm not sure the same kind of rule applies. There are many more packets going back and forth in TCP that aren't DNS, for example the 3-way handshake sequence would not match this rule, which means the remote host would still establish a connection but would not be able to make any DNS ANY query through it.