REQUEST: Dynamic DNS IP support in QPM Limit Bypass List and general white/blacklists

[chmichael]

Hello,
It would be nice to have a Network Access Control List for QPM to disable it for certain IPs.

Thank you

[ShreyasZare]

Thanks for the post. Its already exists, check for "QPM Limit Bypass List" option in there.

[shalafi99]

It might not be exactly what you were looking for, @chmichael, but the DNS server has an API which you can leverage for automated updates using a script. I do that in my setup.

[chmichael]

@ShreyasZare I don't understand why you define it as "feasible". Using a low number eg. 5 dynamic IPs will not affect any perfomance using 1k dynamic IPs might. Anyhow it will query the dynamic ip from the cache so the loss impact is limited. This way you can protect your technitium server from any amplification or other attacks while letting your "known" users enjoy without limits.

I downloaded the source code even if i'm not a c# developer to give a try and i'll let you know.

I guess the place to experiment is at DNSServer.cs:
internal bool IsQpmLimitCrossed(IPAddress remoteIP)

Thank you

[chmichael]

@shalafi you mean using the DNS API to update the QPM bypass list on dynamic ip change ?
In that case you need a Dynamic DNS client to update the Dynamic domain which also will inform the "script" that ip is changed and then script to modify the QPM bypass list. I find this more complex and slower than a signle dns resolve of the dynamic domain inside the technitium.

[shalafi99]

@shalafi you mean using the DNS API to update the QPM bypass list on dynamic ip change ? In that case you need a Dynamic DNS client to update the Dynamic domain which also will inform the "script" that ip is changed and then script to modify the QPM bypass list. I find this more complex and slower than a signle dns resolve of the dynamic domain inside the technitium.

Yes.
Except the dynamic domain update happens somewhere else and asynchronously, so I just look it up on every script run.
The script make a DNS query to find out if it has changed (included some logic to store what the previous check result was) and if true proceeds to make the API call which updates QPM bypass.

I just thought to mention it after Shreyas pointed it out the DNS Server itself will not do it.

[ShreyasZare]

I don't understand why you define it as "feasible". Using a low number eg. 5 dynamic IPs will not affect any perfomance using 1k dynamic IPs might. Anyhow it will query the dynamic ip from the cache so the loss impact is limited. This way you can protect your technitium server from any amplification or other attacks while letting your "known" users enjoy without limits.

Its not feasible because of performance issues. Lets say you have configured 10 domain names to bypass QPM limit. Now, the DNS server has only the client's IP address available and it has to resolve 10 domain names and match with it to see if the client is allowed to bypass. This means each request will generate 10 another requests + its own request. Domain name resolution is also not a straight forward thing and it may take a good amount of time to resolve a single domain name.

So, if you have a setup where the load is 1000 queries/sec and you enable this config, now suddenly the DNS server has to resolve 10 domain names and it may take few seconds of time depending on how its being resolved. Till then, the DNS server will be accumulating 1000 queries every second and some of them may timeout causing the clients to retry again which would then lead to even more queries. Once the domain names are resolved and cached, it will work well but still there is internal load of resolving from cache. And when the cache expires, this issue will again repeat.

Which is why this is not a good option to have. You are still able to configure the bypass list since in most cases you already know the client network to be allowed or on a private network, you can place such clients on a single subnet to allow such a config.