# Thousands of DNS requests for domain

**URL:** <https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182>\
**Category:** Help\
**Created:** [January 7, 2017, 7:41pm UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182 "2017-01-07T19:41:40Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![sschadwick](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/f1d935/32.png) [@sschadwick](https://discourse.pi-hole.net/u/sschadwick)\
**Post date:** [January 7, 2017, 7:41pm UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182/1 "2017-01-07T19:41:41Z")

</div>

Has anyone else seen activity like this? I've been receiving thousands of DNS requests for the `.` domain, all originating from China. Any ideas on how to block/prevent this behavior? I'm mostly worried about 50k requests blowing up my memory at this point.

[http://imgur.com/a/BG0A6](http://imgur.com/a/BG0A6)

---

<div class="post-metadata">

**Author:** ![PromoFaux](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/promofaux/32/1545_2.png) [@PromoFaux](https://discourse.pi-hole.net/u/PromoFaux)\
**Post date:** [January 7, 2017, 7:42pm UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182/2 "2017-01-07T19:42:58Z")

</div>

Do you have any IOT devices on your network? Perhaps ones that have been sourced from cheap chinese sites?

---

<div class="post-metadata">

**Author:** ![sschadwick](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/f1d935/32.png) [@sschadwick](https://discourse.pi-hole.net/u/sschadwick)\
**Post date:** [January 7, 2017, 7:44pm UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182/3 "2017-01-07T19:44:00Z")

</div>

Forgot to mention that I'm running pihole on a DigitalOcean droplet so it is externally accessible.

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [January 7, 2017, 7:45pm UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182/4 "2017-01-07T19:45:02Z")

</div>

Block port 53 and use a VPN if running on a droplet. Open resolvers are bad.

> **[Are You a Zombie? How to Check for Open DNS Resolvers](https://uk.pcmag.com/opinion/16258/are-you-a-zombie-how-to-check-for-open-dns-resolvers)**
>
> Open DNS resolvers can vastly amplify the effect of a Distributed Denial of Service Attack. Is your DNS resolver a member of the DDoS zombie army?

---

<div class="post-metadata">

**Author:** ![PromoFaux](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/promofaux/32/1545_2.png) [@PromoFaux](https://discourse.pi-hole.net/u/PromoFaux)\
**Post date:** [January 7, 2017, 7:45pm UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182/5 "2017-01-07T19:45:44Z")

</div>

Ah, yeah as @DL6ER mentioned, do that! Are they all coming from the same client?

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [January 7, 2017, 7:46pm UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182/6 "2017-01-07T19:46:44Z")

</div>

See our nice wiki article on how to easily set up a VPN. I wrote the tutorial while working on an Ubuntu droplet.

[https://github.com/pi-hole/pi-hole/wiki/Pi-hole---OpenVPN-server](https://github.com/pi-hole/pi-hole/wiki/Pi-hole---OpenVPN-server)

---

<div class="post-metadata">

**Author:** ![sschadwick](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/f1d935/32.png) [@sschadwick](https://discourse.pi-hole.net/u/sschadwick)\
**Post date:** [January 7, 2017, 7:57pm UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182/7 "2017-01-07T19:57:57Z")

</div>

They're coming in from one or two ip addresses, and using `iptables -A INPUT -s <offending ip> -j DROP` doesn't seem to be blocking the requests. I'm also unable to blacklist the `.` domain through pihole.

Wouldn't using OpenVPN on the droplet route all of my traffic through the droplet? I'm already hovering around 50% memory usage, and don't want to nuke my server. Also wouldn't the client only use the DNS when OpenVPN is active, and unfiltered when inactive?

Would using non-standard ports work? So on my clients I could add :3018 or whatever port?

---

<div class="post-metadata">

**Author:** ![firestorrrm](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/f/edb3f5/32.png) [@firestorrrm](https://discourse.pi-hole.net/u/firestorrrm)\
**Post date:** [January 7, 2017, 8:14pm UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182/8 "2017-01-07T20:14:25Z")

</div>

Assuming you're using the base level package for your VPS, you should be fine when installing and using openVPN. It doesn't have a major memory impact.

---

<div class="post-metadata">

**Author:** ![sschadwick](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/f1d935/32.png) [@sschadwick](https://discourse.pi-hole.net/u/sschadwick)\
**Post date:** [January 7, 2017, 8:20pm UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182/9 "2017-01-07T20:20:55Z")

</div>

Running OpenVPN itself might not, but wouldn't routing all my network traffic drive it up?

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [January 7, 2017, 8:21pm UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182/10 "2017-01-07T20:21:40Z")

</div>

> [@sschadwick](#):
>
> Wouldn't using OpenVPN on the droplet route all of my traffic through the droplet?

In standard configuration\*: Yes.

`[*]`: Standard configuration is that the server tells the clients to route all traffic through him

See

> [@Accessing pihole](https://discourse.pi-hole.net/t/accessing-pihole/1134/9):
>
> Okay, then you could set up a VPN which will only tunnel the DNS requests and the admin interface. You should be able to find detailed instructions online, like this one [https://www.debuntu.org/how-to-network-manager-openvpn-overwrites-default-route/](https://www.debuntu.org/how-to-network-manager-openvpn-overwrites-default-route/)[https://community.openvpn.net/openvpn/wiki/IgnoreRedirectGateway](https://community.openvpn.net/openvpn/wiki/IgnoreRedirectGateway) The idea is to simply don't force all traffic through the VPN, but only make the Pi-hole available through the VPN so you can access it locally and manually set it as DNS server.

---

<div class="post-metadata">

**Author:** ![sschadwick](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/f1d935/32.png) [@sschadwick](https://discourse.pi-hole.net/u/sschadwick)\
**Post date:** [January 8, 2017, 11:25pm UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182/11 "2017-01-08T23:25:37Z")

</div>

I'm not eager to setup OpenVPN, as it would require per-device configuration rather than per-network config.

Is there a way to whitelist clients DNS queries while rejecting all other traffic?

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [January 8, 2017, 11:28pm UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182/12 "2017-01-08T23:28:59Z")

</div>

Sure, you can explicitly `ALLOW` certain clients to be able to reach port `53` while `DROP`ing all other requests using `iptables`.

---

<div class="post-metadata">

**Author:** ![sschadwick](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/f1d935/32.png) [@sschadwick](https://discourse.pi-hole.net/u/sschadwick)\
**Post date:** [January 13, 2017, 11:33pm UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182/13 "2017-01-13T23:33:46Z")

</div>

How difficult would it be to implement a client white/blacklist that's accessible via the web ui? I'm very interested in the ability to blacklist malicious clients without having to maintain a whitelist of all of my device ip addresses.

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [January 14, 2017, 8:41am UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182/14 "2017-01-14T08:41:19Z")

</div>

Are you referring to OpenVPN? There won't be any OpenVPN specific settings on the Pi-hole web page. That would go certainly beyond the scope of the web interface of being something nice an comprehensive for Pi-hole matters.

See e.g. this: [GitHub - Chocobozzz/OpenVPN-Admin: Install and administrate OpenVPN with a web interface (logs visualisations, users managing...)](https://github.com/Chocobozzz/OpenVPN-Admin)

---

<div class="post-metadata">

**Author:** ![Anudeep](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/anudeep/32/194_2.png) [@Anudeep](https://discourse.pi-hole.net/u/Anudeep)\
**Post date:** [January 14, 2017, 9:25am UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182/15 "2017-01-14T09:25:22Z")

</div>

Installing OpenVPN admin can cause problems with pihole? There will be conflict for port 80, right?

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [January 14, 2017, 9:30am UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182/16 "2017-01-14T09:30:55Z")

</div>

They say:

> Web server (NGinx, Apache...)

so you may just clone this repo into a different folder in `/var/www/html/` and use your existing `lighttpd` server for this. If that does not easily enough, you can of course also follow their instructions and change the port of the `apache2` websever to something like `8080` afterwards. Or you could maybe configure it to use SSL only (port 443) and access it there. But I'm not an expert when it comes to `apache2` configurations...

---

<div class="post-metadata">

**Author:** ![Anudeep](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/anudeep/32/194_2.png) [@Anudeep](https://discourse.pi-hole.net/u/Anudeep)\
**Post date:** [January 14, 2017, 9:40am UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182/17 "2017-01-14T09:40:47Z")

</div>

So, using port other than 80 just works fine...

---

<div class="post-metadata">

**Author:** ![sschadwick](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/f1d935/32.png) [@sschadwick](https://discourse.pi-hole.net/u/sschadwick)\
**Post date:** [January 17, 2017, 12:49am UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182/18 "2017-01-17T00:49:59Z")

</div>

No, not OpenVPN. I was referring to how pihole uses iptables to open a hole for DNS and web server on ports 53 and 80. I am attempting to `ALLOW` requests on port 53 from my ip address, while `DENY`ing any other requests for port 53.

Since pihole prepends three rules to iptables (`ALLOW` all to port 53 udp/tcp and port 80 tcp, even before ufw rules), these rules supersede any custom firewall rules regarding these ports. Due to another unrelated issue, I have to run the `basic\ install.sh` command with the `--unattended` flag on ever boot. This command however readds the iptables rules if I have previously deleted them. I'm interested in seeing a way to opt-out of prepending the iptables rules, or a way to manage them (possibly including whitelisting ip's) via the web ui.

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [January 17, 2017, 12:53am UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182/19 "2017-01-17T00:53:40Z")

</div>

It would be better to resolve the need to run the installer on every boot. We can look at the firewall issue which should only fire if the ports are blocked, and if that logic needs to be adjusted, then we'll look at that. But first would be addressing the problem of adding the rulesets back in on every boot with the installer.

---

<div class="post-metadata">

**Author:** ![xer0design](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/x/bc79bd/32.png) [@xer0design](https://discourse.pi-hole.net/u/xer0design)\
**Post date:** [January 17, 2017, 3:50am UTC](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182/20 "2017-01-17T03:50:07Z")

</div>

Also having similar issues, I noticed the other day 250,000 requests from a single IP and an identical amount for a single domain. There were also a few in the 10000-20000 request range from other IPs.

I'm running it on ubuntu in the cloud, so it was easy to block all the IPs making the requests ("ufw deny from 1.2.3.4" if anyone is wondering), and that worked for all but one - an ip in korea that for some reason ufw is refusing to block, or it's somehow getting through the block, anyone have any ideas for that? These are all going to a . domain too.

Edit: also not wanting to install a VPN as I use it on my entire networks both at home and at work and straight up refuse to entertain the idea of setting that up for 40+ devices (no router support), plus a few friends use it on their smart tvs and stuff so would like to still have the option open for them.

[Next page](https://discourse.pi-hole.net/t/thousands-of-dns-requests-for-domain/1182.md?page=2)