Hi, Rate-limiting queries per source IP with specific query type (NULL/TXT) and long qname (e.g. 20 byte or longer). That should be possible using iptables hashlimit module and dns-extension [1]. That will make DNS-tunnel VPN useless while accepting legitimate TXT/NULL queries.
[1] https://github.com/mimuret/iptables-ext-dns
