4 ms·

Many dns servers have an option to block rebinding. For dnsmasq it's stop-dns-rebind. I added an exception for Plex, which relies on it for their personal ssl c

Many dns servers have an option to block rebinding. For dnsmasq it's stop-dns-rebind. I added an exception for Plex, which relies on it for their personal ssl certs. Quite a lot of routers use dnsmasq internally. Ideally this would be a default setting.

Stephen304 8y ago
It seems to be the default for Unbound, at least on OPNSense. Though the POC allowed me to discover that my phone had been bypassing my local resolver because I tried to put 1.1.1.1 as a fallback in pihole as second option to my router, but for some reason pihole had been preferring CF over my local router. Edit: To clarify, it seems that unbound by default blocks all RFC1918 addresses in DNS queries unless you specifically allow it for a specific domain (eg. plex.direct). OPNSense doesn't seem to expose an option to allow RFC1918 addresses in all dns responses.
- crtasm 8y ago
  Pihole doesn't fallback, it spreads DNS requests between all the upstream servers you specify. Your router well may do the same.
  - Stephen304 8y ago
    I have OPNSense configured not to forward queries so it uses root servers directly, but it's of no consequence because like I said above, Unbound on OPNSense blocks RFC1918 responses by default anyways. As long as my devices are using my router as a resolver, I'll only get public IPs as responses to DNS queries. My misconfiguration in pihole just temporarily bypassed that.
angry_octet 8y ago
But how long do you block/cache responses for? Many web pages run for days. As evidence: my 300 open tabs.
- vbezhenar 8y ago
  --stop-dns-rebind Reject (and log) addresses from upstream nameservers which are in the private IP ranges. This blocks an attack where a browser behind a firewall is used to probe machines on the local network. There's no TTL, it just blocks any responses with private IP. Might break some software, because that's a legitimate DNS use.
  - amaccuish 8y ago
    Correct. For my internal DNS, I've added the option on the upstream outbound cache, so clients still can resolve the internal dns space.

Stephen304 8y ago

It seems to be the default for Unbound, at least on OPNSense. Though the POC allowed me to discover that my phone had been bypassing my local resolver because I tried to put 1.1.1.1 as a fallback in pihole as second option to my router, but for some reason pihole had been preferring CF over my local router. Edit: To clarify, it seems that unbound by default blocks all RFC1918 addresses in DNS queries unless you specifically allow it for a specific domain (eg. plex.direct). OPNSense doesn't seem to expose an option to allow RFC1918 addresses in all dns responses.

crtasm 8y ago
Pihole doesn't fallback, it spreads DNS requests between all the upstream servers you specify. Your router well may do the same.
- Stephen304 8y ago
  I have OPNSense configured not to forward queries so it uses root servers directly, but it's of no consequence because like I said above, Unbound on OPNSense blocks RFC1918 responses by default anyways. As long as my devices are using my router as a resolver, I'll only get public IPs as responses to DNS queries. My misconfiguration in pihole just temporarily bypassed that.

angry_octet 8y ago

But how long do you block/cache responses for? Many web pages run for days. As evidence: my 300 open tabs.

vbezhenar 8y ago
--stop-dns-rebind Reject (and log) addresses from upstream nameservers which are in the private IP ranges. This blocks an attack where a browser behind a firewall is used to probe machines on the local network. There's no TTL, it just blocks any responses with private IP. Might break some software, because that's a legitimate DNS use.
- amaccuish 8y ago
  Correct. For my internal DNS, I've added the option on the upstream outbound cache, so clients still can resolve the internal dns space.