8 ms·
Some Fritz!Box modems might have been hijacked
- AmazingTurtle 2y agoMy Fritz Box does not reply in that way. How come you indicate that _all_ Fritz Box Modems have been hacked and how do I know if I am affected? Apparently I'm not.
- mmcnl 2y agoIt's how the mechanism of DNS suffices works. Especially on Windows, because Windows rewrites all DNS requests with the suffix (even simple requests like google.com). To me it's surprising that somehow not everyone is affected. I only learned that in the comments here.
- kurtextrem 2y agowhat happens in chrome, where afaik google's dns is the default?
- Springtime 2y agoI was wondering when that .box TLD would become a liability for them.
- raverbashing 2y agoYeah. Now imagine the liability behind the .zip tld
- diarrhea 2y agoI own a domain along the lines of 'invoice.zip', I thought it’d be fun. But so far, it’s just been useless and expensive. Should I keep it? What are uses cases for such a 'misguided' domain? I thought about putting a blog on it but fear it’d get flagged as malicious left and right. It’d look odd to say the least. If I don’t renew, scammers might get their hands on the domain.
- raverbashing 2y ago> What are uses cases for such a 'misguided' domain? Anyone who has invoice.zip on an email should see that as a clickable link if the url detection is right Then for example you put a file on / of your domain that downloads a malicious .zip file See where this is going?
- diarrhea 2y agoI meant: legitimate use cases. And I don’t buy into .zip being made part of automatic URL detection in tools, for all the illegitimate reasons it’ll be used for. Vendors of email clients, messengers and chat applications tend to stick to a core of well-known TLDs.
- Terr_ 2y ago*shakes cane from porch* If I had my 'druthers, there would be zero new TLDs except for country-codes which indicate the a top-level legal jurisdiction over who gets to decide the rest of what happens under 'em. 'Course, that could still backfire this way if someone establishes the Republic of Boxsylvania and won't accept "bx". (Also not great if we enter into an era of unprecedented national mergers, splits, and renames.)
- sph 2y agoWhat is worse is that you cannot change your DNS domain from fritz.box. I looked in the settings many times and was unable to find how to do that.
- tetris11 2y agoAnother reason to point your Fritzbox to a Pihole/Unbounded combo device. FWIW is it not easy for Fritz to remotely change the default DNS of their devices, similar to what Virgin/Sky/Vodafone modems have been doing for the past decade? Fritz used to be open source, but they're not since also around a decade, so I would think it would be easy to for them to have a backdoor to all their modems like every other company does.
- sema4hacker 2y agoShouldn't the title say "can be" not "have been". Apparently this has been known for years.
- mmcnl 2y agoImo if DNS requests resolve to an unknown entity and you cannot change that behavior, your DNS resolution has effectively been hijacked, even if no harm is being done yet. (PS. I am the author.)
- PaulKeeble 2y agoI am just not interested in a router that isn't running open source firmware ever again. Not only do they have all the features you might need but the updates keep coming alongside all the nice security patches. I wish more WiFi devices for access points got their code into the kernel quicker so the support was more extensive.
- tetris11 2y agoFritzbox was one of the first open source modem/router combo boxes though. They closed the source a few years back, but in terms of openness there really is nothing else in the modem/router combo space that is actually open source.
- swores 2y agoMost people who want a router with open source firmware get one that's compatible with OpenWrt and use that, is there a reason you don't consider that to be using open source firmware?
- tetris11 2y agoRouter. I'm asking about a modem, or a modem/router combo that every company makes, but doesn't exist in the open hardware world. I love my wrt54gl as much as the next guy, but I hate having two devices to connect to the internet instead of just one.
- moviuro 2y agoSearch forums local to your country and write documentation on how to use Linux or BSD as a modem. For OpenBSD on Orange France FTTH: https://lafibre.info/remplacer-livebox/remplacer-sa-livebox-par-openbsd-128033-7-2-dual-stack/ https://lafibre.info/remplacer-livebox/remplacer-sa-livebox-... or https://try.popho.be/securing-home2.html https://try.popho.be/securing-home2.html
- 2y ago
- compumike 2y agoThis is a good reason to use domain names with a trailing dot, right? Such as https://news.ycombinator.com./ https://news.ycombinator.com./ to specify a FQDN, instead of https://news.ycombinator.com/ https://news.ycombinator.com/ which is not fully qualified. The trailing dot keeps the DNS resolver from trying system domain suffixes.
- farhaven 2y agoIn this case, that won't help, because `.box` is already a TLD and `fritz.box` has been registered by someone. Compare these two, the first is from my laptop connected to a Fritz!Box, the 2nd. one is from a server that's not connected to any sort of Fritz!Box: Expected result, resolved by the box itself: $ host fritz.box. fritz.box has address 192.168.178.1 fritz.box has IPv6 address fd00::e72:74ff:fece:6656 fritz.box has IPv6 address 2a02:908:616:a8c0:e72:74ff:fece:6656 Result if for some reason, DNS resolution fails on the box (e.g. you're not connected to your own network, someone disabled the resolver on the box, someone configured a non-box DNS on your machine): $ host fritz.box. fritz.box has address 45.76.93.104 fritz.box has IPv6 address 2001:19f0:6c00:1b0e:5400:4ff:fecd:7828
- FL410 2y agoYour query results make sense, since the Fritz!Box is authoritative for the (local) .box tld. Try again with google.com and google.com. If you're using Windows, it should append .fritz.box to the former, which is the issue here.
- compumike 2y agoI'll note that many websites do NOT support this: https://duckduckgo.com./ https://duckduckgo.com./ - blank page https://www.google.com./ https://www.google.com./ - 301 redirect to non-trailing-dot https://www.amazon.com./ https://www.amazon.com./ - works But even "works" means that the page makes lots of requests to other subdomains etc which do not have the trailing dot, so are still vulnerable for DNS hijack if you have search domains set on your system. So while using domains with a trailing dot is a strongly good idea for calling APIs, etc. it is not a practical solution for the end user with a web browser.
- andersa 2y agoHmm. My parents have one of these. Any advice on how to fix it? "Stop using it" obviously isn't an option. - Does configuring a custom DNS server (like Cloudflare one) on your local computers solve it? - On the reddit linked at the bottom of the article, someone mentions you can easily use this tool https://www.mengelke.de/Projekte/FritzBox-JSTool https://www.mengelke.de/Projekte/FritzBox-JSTool to edit the configuration file and change the domain. If that's true, why is the article claiming it's impossible to change?
- mmcnl 2y agoAs far as I know, this changes the hostname of the modem, but it doesn't change the DNS suffix in the DHCP server. (PS. I am the author. The article is my understanding of the situation but if I'm wrong on some parts please correct me.)
- farhaven 2y ago> Does configuring a custom DNS server (like Cloudflare one) on your local computers solve it? No. If anything, that'd make it worse. The issue reported in TFA is that Fritz!Boxes by default resolve the domain `fritz.box` to themselves for their admin interface, even if that domain has been registered on the public internet by someone else. If you configure cloudflare, you'll prevent that, which will _always_ get you the potentially attacker controlled DNS results.
- avidiax 2y agoThere is a 2nd issue. If you have a local machine called "myshare" and you mistype "myhsare", it may resolve to the attacker's machine.
- fsckboy 2y ago>"Stop using it" obviously isn't an option. we're only talking about the cost of a commodity modem, so buy a new modem, disconnect old is a potential solution
- rakamotog 2y ago
- yjftsjthsd-h 2y agoAnother reminder that if it's not a reserved (top level) domain it's not safe:\
- Jan78 2y ago[dead]
- choeger 2y agoWait a second. Does that mean every DNS request on a Fritz Box network is send to fritz.box first? I query google.com and get google.com.fritz.box every fucking time? Shit.
- greyface- 2y agoIf your upstream recursive resolver does QNAME minimization, then the only query that will leak beyond them is for "com.fritz.box", and because that's a NXDOMAIN, no further query for "google.com.fritz.box" is made. If your upstream recursive resolver doesn't do QNAME minimization, then yes. Edit: I stand corrected, see downthread
- jiveturkey 2y agothat’s no saving grace. the fritz resolver would return a result for com.fritz.box so that it can see the full (or next successive) part of the query. qname minimization is useful to defend against on path interception, or data collecting resolvers, not against actively hostile resolvers
- greyface- 2y agoCompletely agree that it creates an unacceptable risk if the fritz.box owner is malicious. I'm just pointing out that currently, com.fritz.box doesn't appear to resolve. Edit: actually, I'm wrong, "NS? com.fritz.box" returns a NOERROR + fritz.box SOA instead of a NXDOMAIN, which causes QNAME minimization to make the full query, which returns an A. QNAME minimization indeed doesn't actually help.
- avidiax 2y agoIt resolves for me: com.fritz.box. 3514 IN AAAA 2001:19f0:6c00:1b0e:5400:4ff:fecd:7828 com.fritz.box. 3600 IN A 45.76.93.104
- mmcnl 2y agoYes, on Windows at least. As far as I know, Linux and macOS only use the DNS suffix for domains without a dot in the domain.
- Trufa 2y agoI mean, what I found interesting that nobody in the company heard that they were registering .box domains. I am no expert in this subject https://newgtlds.icann.org/en/program-status/sunrise-claims-periods/box https://newgtlds.icann.org/en/program-status/sunrise-claims-... But it seems that they had Trademark Claims Period: 13 September 2023 to 17 January 2024 To be fair, .box domains didn't have that much noise attached to them and 4 months is a relatively short period, but if this possible vulnerability had known then it's a little more negligent. Best case scenario for them seem to be that they pay an undisclosed amount to a "random" that got lucky and bought that domain. I find it interesting how a decision that may have looked totally innoxious something like 15 years before, was not future proof enough, I for one back then would not have imagined that ICANN would start registering every single TLD under the sun.
- orliesaurus 2y agoI have one of these but it's 10k miles away from me.... Gonna have to remind me this summer to look into it
- mahkoh 2y agoAdding the following to your local systemd.network configuration file should resolve the issue: [DHCPv4] UseDNS=false [DHCPv6] UseDNS=false But you will have to type the IP of the fritz box when you want to access the admin interface.
- FL410 2y agoDoes this not just break all DNS-resolved internet traffic for these devices at this point? Seems like the resolvers for fritz.box. are resolving *.fritz.box. to 45.76.93.104. I would assume the affected (Windows?) clients aren't working at all when they get this kind of response for something like google.com.fritz.box.
- mmcnl 2y agoI guess if the resolution fails Windows will fallback to a resolution without the DNS suffix, but I'm not entirely sure how it works, and what other operating systems do.
- FL410 2y agoBut the resolution doesn't fail, it just returns an incorrect A record. Have you tried it on a Windows PC?
- baobabKoodaa 2y agoCan anyone explain the design decisions behind this product? Or can the design process be summarized as "let's light these matches and see what happens"?
- growt 2y agoHere in germany you often get a Fritz Box from your internet provider (preconfigured with access data). So for 99% of users, switching to another router is not an option because thats simply the device that came with their internet access. But apart from this issue those are really nice and capable devices.
- dminuoso 2y agoYou can use your own router in Germany, this is enforced by the regulation agency BNetzA. Your ISP must provide you with sufficient information to set it up.
- jeroenhd 2y agoI think it's fair to say the vast majority of users won't be able to pull that off. I doubt even half of them know what a router is, let alone that there are differences between models. For those who know they can use their own modems, sufficient information must be available, but only a sliver of the people with AVM modems will have that kind of knowledge.
- namibj 2y agoThere is the class that fails at reading and adhering to IKEA instructions, yeah. But this is something that ask the non-obvious things will get explained to you if you walk into a MediaMarkt to where modern routers are and queue in line for the area's sales person to get to you and tell you what to buy, and how to get your hands on the relevant access credentials/how to get the new one to connect to the ISP. You're forgetting that most installs of non-ISP-provided moderns for residential Internet are set up by the tech person of the household who quite possibly never heard of what a NAS is and why they may want one. Often the only paper manual thing in the box is literally the quick start guide that a motivated person who has what could be called "common sense" on treatment of/interaction with computing equipment. You know, the person who knows to check the plugs because they don't consider themselves above it but do know that it's one of if not the first thing they are asked if they can support.
- 2y ago
- __michaelg 2y agoThis is stupid clickbait title, and the article isn't even very precise. Yes, that whole fritz.box situation is known and bad. But the problem discussed here doesn't nearly apply to every situation. Specifically, the box's builtin resolver (which is still used by default by a lot of things) knows not to forward fritz.box requests to the outside. That is, `dig google.com.fritz.box` and everything else say NXDOMAIN when you're using the builtin DNS.
- brewmarche 2y agoOut of curiosity, what happens with a custom DNS server but still using DHCP? Will the suffix still be used?
- tetha 2y agoAh, it was looking like that to me, thanks for confirming. Like, if I force dig to use some public DNS, I get the newly registered IPs but if I use my fritzbox as the DNS server, it gives me itself / NXDomains, except for hostnames configured on the local fritzbox. That on top of the fact that my linuxes won't use the search domain unless explicitly asked for with a single-label DNS makes this a lot less scary.
- mmcnl 2y agoI am the author and happy to make any corrections. In Windows performing a lookup for google.com returns the address of the fritz.box domain name. PS C:\Users\Marco> nslookup google.com Server: UnKnown Address: 192.168.0.200 Non-authoritative answer: Name: google.com.fritz.box Addresses: 2001:19f0:6c00:1b0e:5400:4ff:fecd:7828 45.76.93.104 How is this not bad?
- Jan78 2y ago[dead]
- jmbwell 2y agoYeah but so many things bypass internal resolvers lately. VPNs, “private relay,” individual apps. DNS over HTTP. Local control over DNS is steadily being chipped away. The result is some apps will go out to public or vendor-controlled DNS in ways typical admin tools like ping and dig might not reveal
- jorams 2y agoSkipping over the bad idea that this fritz.box-domain is for a bit, this seems like a pretty major failure on the part of ICANN to prevent name collisions. IIRC they had a whole bunch of plans and policies to prevent name collisions 10 years ago, but somehow a popular brand of modems failed to come up?
- POM37 2y agoAVM the Company behind the fritzbox is aware of this issue and are currently already in talks with the domain provider. https://x.com/AVM_DE/status/1779155999204552897 https://x.com/AVM_DE/status/1779155999204552897
- mmcnl 2y agoThis is mentioned in the article, and the article also states why only purchasing the domain is not an adequate solution.
- thehias 2y agoThis is FUD, the domain was taken down by URS in March. https://www.heise.de/news/Fritz-box-Domain-aus-dem-Verkehr-gezogen-9647776.html https://www.heise.de/news/Fritz-box-Domain-aus-dem-Verkehr-g...
- sph 2y agoNonsense. The domain is registered. https://who.is/whois/fritz.box https://who.is/whois/fritz.box Also, this should be worth an email to abuse@namesilo.com, no?
- deleted 2y ago[deleted]
- sph 2y agoI have a Pi-Hole w/ unbound upstream, and the pi-hole is set to conditionally forward requests to *.fritz.box to 192.168.178.1, but should not forward it outside (i.e. to unbound). Quote: "You can also specify a local domain name (like fritz.box) to ensure queries to devices ending in your local domain name will not leave your network, however, this is optional." This is in the Conditional Forwarding section to the Pi-Hole, so I assume it's OK.
- corney91 2y agoYeah, similarly I use Adguard Home and have this in my upstream config, so I'm hoping I'm safe from this: [/fritz.box/]192.168.178.1
- big_paps 2y agoDoes not seem to be the case anymore: https://www.heise.de/news/Fritz-box-Domain-aus-dem-Verkehr-gezogen-9647776.html https://www.heise.de/news/Fritz-box-Domain-aus-dem-Verkehr-g...
- mmcnl 2y agoThe domain is still not owned by AVM so it's still hijacked.
- jeroenhd 2y agoAs far as I can see, Heise assumes that just because there's a link to the URS, the domain is no longer under someone else's control. I can't find any confirmation that the URS has actually been invoked. If I were someone trying to spy on specific users, or collecting data maliciously, I would host this HTML on my own server to confuse journalists. Currently, every subdomain (up to any level, as far as I can tell) resolves to an IPv4 and an IPv6 address. I doubt ICANN would do this for seized domains.
- Jan78 2y ago[dead]
- brewmarche 2y agoTime to make the suffix configurable and default it to something standard like home.arpa (or .internal once it’s official) or a sub-domain thereof, AVM. To me the root problem still seems to be that we use FQDNs virtually nowhere even though that is the intention. Linux and macOS not applying the suffix for multiple labels is just an implementation detail. Maybe we should standardise the behaviour and maybe it’s better to turn it around: consider everything an FQDN and provide an escape mechanism (e.g. an xx-- prefix or an escape TLD)?
- moeffju 2y agoI flagged this post because it's just spreading FUD (in the traditional meaning) at this point. The fritz.box domain had been registered in January, but someone (likely AVM) quickly contested the registration and it was disconnected in March. It is currently in the settlement and resale phase, so very likely AVM, the makers of Fritz! Box, will just buy the domain and ensure it responds NXDOMAIN to any query or something. While I still believe that using a non-reserved domain like 'fritz.box' as their internal domain and suffix is just dumb, they are aware of the issue and working on a resolution that appears sensible.
- mmcnl 2y ago(I am the author) The fact is that currently DNS requests are forwarded to an unknown entity. The matter is not resolved yet and there is no guarantuee it will be resolved. Imo there's no FUD here. I will happily correct any factual errors ofcourse.
- tapper 2y agoOpenWrt For the win!
- jcalvinowens 2y agoMy home router is an old PC running Linux with some extra 10G ixgbe cards. If you know how to configure it, I'm convinced there isn't a better way: the only real downside is the power use, and it's not that bad.
- frankjr 2y agoMost of Germany (and Czechia, maybe even Europe?) is still rocking xDSL lines, so at the very least you still need a modem.
- ffsm8 2y agoWhere did you find a modem card? I tried to do that a few months ago too, as I'm already running a homelab server 24/7, but couldn't find any cards supporting vdsl nor cable Or do you mean just as a wan connection/router? In that case... Sure, you can do that. I just don't see the value in that, personally.
- jcalvinowens 2y agoI don't care about the L2 interface. I imagine I could twist my ISPs arm and spend a bunch of money to end up with the fiber line directly connected to a card in my Linux box... but why? The ISP's upstream equipment is just as vulnerable as a modem, and there's a lot more of it. That's not the point for me. When I had DSL (and later DOCSIS), I just bought my own modems that weren't routers, and used ethernet to connect the Linux router (a raspberry pi 3 originally, yes the DSL was so slow it wasn't a bottleneck!). It was economical because Time Warner charged me something like $5/month to use their modem. There's a lot of reasons I like having a Linux router, a short list: * I have 10G internet from Sonic, in 2020 building a small Linux machine with ixgbe cards was cheaper than any commercially available 10G router with as many ports as I needed (4+). I get line rate through it, no problem. * It runs an open source NAT implementation that is actually correct (although this is less of a problem with commercial routers now than it was back in the day...). Sadly, I don't have IPv6, but the same argument would apply there. * I can run whatever DHCP server implementation I want. * No web GUIs: I SSH to the thing and write config files. * If it blows up, it's just Linux, and all the config files are in git: any machine will do, I don't have to worry about some commercial product disappearing and forcing me to waste an afternoon reinventing the wheel. * I can build and run recent vanilla kernels with all the hardening options enabled. A Linux router spends 99% of its time in the kernel. * The machine is actually fast enough to scan 10G traffic at line rate in software when I want to do that (it's doing all the routing in software, after all). It's really easy, I'd estimate I spend 1-2 hours a year maintaining it.
- peanut-walrus 2y agoHm, curious behavior on my Windows box: nslookup is indeed always applying all the search suffixes whenever I do a lookup, but if I just use the normal resolution process (for example running `ping www.google.com` etc), then the value of `HKLM\Software\Policies\Microsoft\Windows NT\DNSClient\AppendToMultiLabelName` is respected, which defaults to 0 since Vista. So this shouldn't really be an issue for most people, but highlights once again that you should never ever use a domain in your infrastructure that you do not own or at the very least use one of the suffixes from https://www.rfc-editor.org/rfc/rfc6762#appendix-G https://www.rfc-editor.org/rfc/rfc6762#appendix-G
- mmcnl 2y agoCan we be absolutely sure the "normal resolution mode" is always used? I'm happy to accept that impact might be not as severe as stated, but to me it's very scary that a simple nslookup for google.com returns the IP address of fritz.box.
- freitasm 2y agoI replaced a Fritz.Box many years ago and a Windows-based laptop I have here still tries a lookup to frit.box every few seconds. It's Monday morning here and I just started the laptop. It's still doing lookups on fritz.box. Does anyone know where and why Windows is requesting this?
- hacst 2y agoThat matches my observation on Windows 11. Looking at wireshark while doing the resolution I see the following: Normal queries never use the the suffix. nslookup does, which the resolver answers with NXDOMAIN Fritz box allows you to capture traffic towards the ISP too and there I never see such a suffix query in either case. So I assume the fritz resolver directly responds to those. That does not really match the behavior described in the OP but I would be very surprised if the behavior described there wouldn't have lead to a big outcry much earlier.
- zirror 2y agoI can't reproduce the "worst case" i.e. that if I ping "google.com" it gets first sent to "google.com.fritz.box". I'm on windows 10 and have a FRITZ!Box 7590. If I ping "google.com" It just queries google.com If I ping a domain I have never visited it just does a query for that domain. It only appends .fritz.box if I, e.g. only ping "google". So maybe they fixed it? I also changed quite a lot of settings throughout the years.
- r9295 2y agoCache perhaps?
- qilo 2y agoThere's a registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\DNSClient\AppendToMultiLabelName [default value - 0 (Do not Append Suffix)] which resolver built into Windows (DNS Client) respects. nslookup contains its own DNS resolver and does not rely on the resolver built into the operating system. The DNS (multi-label) query packets sent by the nslookup tool will append the domains listed in the suffix search order (or primary DNS suffix if the list is empty) irrespective of that registry key. In summary, don't use nslookup to try to get insight into what actually happens when apps/services try to resolve names. ping is probably a better bet, at least it uses Windows resolver which honours the above registry key.
- deleted 2y ago[deleted]
- adrium 2y agoToo bad, I tried to buy that domain some years ago as soon as I got my first fritzbox. Back then, I did not find a registrar and did not invest much time in finding one. I am running my own DNS server and configured the fritz.box zone. Very unprofessional of the vendor to assign a public domain. Good reminder to always use https://www.iana.org/domains/reserved https://www.iana.org/domains/reserved and maybe https://www.theregister.com/2018/02/12/icann_corp_home_mail_gtlds/ https://www.theregister.com/2018/02/12/icann_corp_home_mail_... They should just release a firmware update that replaces the domain suffix and ultimately to make it configurable.
- lexicality 2y agoit wasn't a public TLD until this year when it was registered to be a web3 thing
- lolinder 2y agoIt doesn't matter, it's never been a good idea to use a domain that isn't your own or a special-use domain. At some point this might have been a theoretical worry, but it was 13 years ago that ICANN started creating new TLDs by the dozen. There's very little excuse for not correcting this mistake for new hardware at some point in the past 13 years.
- nebulous1 2y agoI have to admit that I got stung when google released .dev as HSTS only, although that was only for local testing. I'm surprised that this company didn't realise that this was problematic before this happened. Also, if the response in the article is actually their only one so far, that's a "I'll never touch this company again" response. If they deal with it properly then it's just a bug.
- scrps 2y agoHaving never played with one; if the firmware supports bridge mode that will treat the box as basically just a hop. Of course you'd have to have your own network gear behind it. Other option, run your own DNS + DHCP stack, a pihole is pretty turn-key if you have a straight forward network.
- DogRunner 2y agohttps://www.mengelke.de/Projekte/FritzBox-JSTool https://www.mengelke.de/Projekte/FritzBox-JSTool allow changing the domain of the fritz box routers. It should be enough to fix that issue
- Arcuru 2y agoIs there a way to get a monthly/weekly/whatever announcement of just the new gTLDs coming out? I have never been able to find a method other than manually checking on ICANN.
- 66fm472tjy7 2y agoI cannot confirm this behavior. With a router running FRITZ!OS:7.57 configured to use Google's DNS (in the router only) I get the following on Windows 10 > nslookup google.com Server: fritz.box Address: fd00::[redacted] Non-authoritative answer: Name: google.com Addresses: 2a00:1450:4001:828::200e 142.250.181.238 Update: the connection does have the DNS suffix, so according to the superuser answer linked in OP (which is the first result when looking up what a DNS suffix is), it should get appended to lookups on windows, but it looks like it isn't in my case. > ipconfig [...] Connection-specific DNS Suffix . : fritz.box
- mmcnl 2y agoI noticed a lot of comments explaining the same thing, but also some confirming my observations. So far it appears the issue is mostly present if you have configured a separate DNS server in the DHCP settings, e.g. DNS is resolved somewhere outside the Fritz!Box. I will investigate further and update the article.
- deleted 2y ago[deleted]
- michael9423 2y agoIsn't a simple solution to simply blacklist fritz.box when using adguard or nextdns?
- tomputer 2y agoIt seems the domain fritz.box has been suspended. March 5 was the first time this message got captured on archive.org[1]: The Domain Name you have entered is not available. It has been taken down as a result of dispute resolution proceedings pursuant to the Uniform Rapid Suspension System (URS). The fritz.box name servers also point to URS[2] name servers: Name Server: ursns1.viagenie.ca Name Server: ursns2.viagenie.ca [1] https://web.archive.org/web/20240305162200/https://fritz.box/ https://web.archive.org/web/20240305162200/https://fritz.box... [2] https://www.icann.org/urs-en https://www.icann.org/urs-en
- senectus1 2y agohuh, glad i swapped my fritzbox out about 6 months ago for a fanless opnsense.
- freitasm 2y agoI've noticed my Synology NAS doing lots of DNS lookups for [synology service].synology.com.fritz.box. Because I had *.fritz.box DNS blocked on my Cloudflare Zero Trust Gateway, these were returning NXDOMAIN, causing the NAS to fail during some operations (checking for software and packages updates, backups). I've disabled the option "Apply the domain name provided by DHCP server" (Network | DNS | Advanced) and the NAS stopped these. Now, this is a worry because that option is checked by default so how many Synology NAS could be trying to connect to these sub-domains? What if the block is removed and the new owner can actually create some of these? More details: https://www.geekzone.co.nz/forums.asp?forumid=66&topicid=312493&page_no=2#3224750 https://www.geekzone.co.nz/forums.asp?forumid=66&topicid=312...