Hi,
I'm running a public authoritative DNS server (non recursive). I am getting hundreds of bogus requests a minute from a specific IP and would like to block this IP. I've added the IP to an inbound Blocked IP rule in Windows firewall but it doesn't seem to be blocking it. When I sniff the traffic with Wireshark I see the request come in and a response go out from our DNS server. So it is still getting a packet to our DNS server.
When I add a test IP from our network to this same rule it seems to block the traffic and not send out any packets from the DNS server.
Anyone have any insight on why this would be or what to check further? Thanks!