1

To ensure better monitoring of my home network (parental control) I tried and set up a Raspberry Pi with dnsmasq and added in some rules to the dnsmasq.conf, that basically come down to the following:

address=/filtered.website/192.168.178.49

I set this up, and as long as I use IP addresses that are outside the range of 192.168.178.###, everything works fine. I now planned on wirining these websites with a local warning message so that not only the browser shows an error, but the user gets a warning.

To process all DNS queries though the Pi, I used the Fritz!Box settings and set both primary and secondary DNS server to the Pi's address. Everything resolves as wanted, except for domains that thus resolve into my local network. Is my router just trying to 'protect me' from websites redirecting to my local network or what's up?

Thank you for your time and help!

1
  • More detail is required. So you are replacing the IP addresses of blocked sites? On the clients do they resolve correctly to your new IP addresses through a ping? If so are you sure that the 192.168.178.### address they return is that of the Pi and it is running a web server that will accept all site names correctly? What happens if you manually go to that IP from one of the client browsers?
    – Dave C
    Mar 25, 2013 at 1:50

4 Answers 4

1

I think I found the solution to the problem I had myself: The Fritz!Box actually tries to protect you from domain names that resolve into your home network.

I cite http://service.avm.de/support/en/SKB/FRITZ-Box-7360-int/1274:No-DNS-resolution-of-private-IP-addresses:

For safety reasons, no DNS resolution of private IP addresses

If a DNS query from a DNS server on the Internet is answered with an IP address from the FRITZ!Box home network, the FRITZ!Box does not forward this DNS reply to the network device. This is a security feature of the FRITZ!Box to protect you from so-called "DNS rebinding attacks"

If anybody still got ideas on how to work around this or disable this feature, I would be honored to see them around.

1
  • Newer Fritz OSes have the option to add some hostnames which are excluded for DNS rebind protection. It's in the network settings.
    – Henning
    May 12, 2020 at 20:33
1

As allready said, this is a security feature. Exceptions for local IPs can be defined by configuring the router.

Configuring the FRITZ!Box

  1. Switch to the "Advanced View".
  2. Click "Home Network" in the FRITZ!Box user interface.
  3. Click "Network" in the "Home Network" menu.
  4. Click the "Network Settings" tab.
  5. Enter the name of the domain for which DNS rebind protection should not >apply in the "Domain name exceptions" field. If you wish to enter several domain names as exceptions, separate the domain names from each other with a line break.
  6. Click "Apply" to save your settings.
1

The key part is "except for domains that thus resolve into my local network."

I had the same issue and this fixed it.

The FritzBox has a security feature which you need to override.

All you need to do is add your the domain to the list of exceptions. Follow the instructions in the following link.

http://en.avm.de/nc/service/fritzbox/fritzbox-7390/knowledge-base/publication/show/663_No-DNS-resolution-of-private-IP-addresses/

Also you may need to update your firmware for the option to show up.

Firmware version: 84.05.51

Kind regards

0

I see two options for you.

Option 1 - changing dnsmasq option on the fritzBox

I do not own a FritzBox but if like many routers it is usinf dnsmasq, you can usually use one of the dnsmasq option related to DNS rebind, see the man page, or here is the essential part:

--rebind-localhost-ok
Exempt 127.0.0.0/8 from rebinding checks. This address range is returned by realtime black hole servers, so blocking it may disable these services.
--rebind-domain-ok=[<domain>]|[[/<domain>/[<domain>/]
Do not detect and block dns-rebind on queries to these domains. The argument may be either a single domain, or multiple domains surrounded by '/', like the --server syntax, eg. --rebind-domain-ok=/domain1/domain2/domain3/

You can see that the option --rebind-localhost-ok is kind of made for DNS black hole like you want to create. However, you cannot really use this option to answer something else than a loopback address. So it might not fit to your need.

Note that I have no clue if using a FritzBox, you can override dnsmasq options somewhere.

Option 2 - changing your DHCP DNS setting on the router

If you cannot change the parameters of dnsmasq on your FritzBox, then you still have another option. In your DHCP settings on your FritzBox, set there the DNS entry to point to your Raspberry Pi. What you have currently is a client request a DHCP address to your router, the router replies with an IP, gateway (the router IP to access the internet) and a DNS (which I bet is the router IP again). Now when your client query a domain name, this is forwarded to your router DNS forwarder, which forwards it to your Pi, and then back.
If you do the suggested change, your clients will get during the DHCP transaction the DNS IP from your Raspberry Pi directly. So you won't get the rebind warning anymore :-)

PS: there is also a project called Pi-Hole which could help you.

PS2: edit after checking the Pi-Hole project, someone suggested in an issue my option 2 as a resolution for using Pi-Hole and a FritzBox. https://github.com/pi-hole/pi-hole/issues/1271#issuecomment-282295061 so I guess option 2 is the recommended solution.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .