Generate iptables rule to block incoming DNS request (Use for DNS amplification attacks)

filterdns.py

#!/usr/bin/python

# You can also do it by hands:
# iptables -t filter -A FORWARD -p udp -m udp --dport 53 -m string --hex-string "|05|yadro|02|ru" --algo bm -j DROP

import sys
import os

if len(sys.argv) < 2:
    sys.exit('Usage: %s domain.com' % sys.argv[0])

domain_name = sys.argv[1]
hex_code = ''

one_word = ''
words = []

for letter in (domain_name + '.'):
    if hex(ord(letter)) == '0x2e':
        words.append(one_word)
        one_word = ''
    else:
        one_word += letter

for word in words:
    hex_code = hex_code + format(len(word), '02x') + ' '
    for letter in word:
        hex_code += letter.encode("hex") + ' '

hex_code += format(0, '02x')


execute_commend = ("/sbin/iptables -t filter -A FORWARD --protocol udp --dport 53 --match string --hex-string \"|"+hex_code+"|\" --algo bm -m comment --comment \""+domain_name+"\" --match recent --name DNST --update --seconds 120 --hitcount 5 --jump DROP; "
    "/sbin/iptables -t filter -A FORWARD --protocol udp --dport 53 --match string --hex-string \"|"+hex_code+"|\" --algo bm -m comment --comment \""+domain_name+"\" --match recent --name DNST --set --jump ACCEPT")
os.popen(execute_commend)

sys.exit(execute_commend)