How to prevent abuse by using amplification/reflection DoS attack? about eturnal HOT 2 OPEN

Change the default ports for starters.

XMPP clients will get the info via XEP-0215.

from eturnal.

The DFN-CERT sent the warning below for our STUN server

We got the same email 😄

Unfortunately, there's no proper fix, as:

1. per the spec, servers reply to unauthenticated requests, and
2. it's not possible to reduce the amplification factor to 1 without breaking compatibility (at least the factor isn't anywhere as bad as with some other protocols, e.g. DNS).

As for workarounds, the only general recommendation is the one @licaon-kter mentioned, i.e. using a non-standard port. I guess the DFN-CERT might still discover you, but chances are the script kiddies won't. I was pondering with adding this hint to the documentation indeed.

from eturnal.