I'm having a major issue with my home server. I'm running on a Minisforum M1-1295 with Windows 11 and using several Docker containers, including AdGuard Home. Lately, I've been hit with an overwhelming amount of DNS requests—about 200 per second—from two domains: vpnv.shop and v2z.ru. I isolated the problem by using a Docker container called nicolaka/netshoot to monitor the requests live. When I stop the AdGuard service, the requests stop too, but I really need AdGuard running. I've reinstalled the AdGuard container twice and checked for any services causing the issue, but nothing seems to work. I've even run full scans with Windows Defender to rule out malware. For now, I've stopped using AdGuard to avoid lag, but I need to fix this. Any ideas?
3 Answers
It sounds like you might be exposing your DNS to the internet inadvertently. Did you check if your router is forwarding UDP port 53 to your AdGuard installation? That could open you up to DNS amplification attacks from bots. You might want to consider limited exposure by using DoH or DoT, which only requires port 443 or 853. This way, you’ll reduce the risk of bot traffic abusing your server.
You might want to verify if DMZ is enabled on your router. That could be exposing your server to the internet and attracting unwanted bots. A reboot of your router along with a clean install of AdGuard could help mitigate the noise you're experiencing.
This could very well be a VPN leak. Have you tested your VPN connection with different settings or switched to another VPN service? Sometimes the VPN can leak DNS requests if not properly configured, causing unexpected traffic.
I tried switching Tailscale off, but the requests kept coming.
I didn't forward that port on the router, just on AdGuard itself. Is that a problem?