1

I have a router running the latest version of Advanced Tomato. Attempting to access a server on my home network (the same network as the router in question), by using my domain name (as opposed to my IP address) fails and I get the following warning in my router logs:

Jun 19 20:45:13 unknown daemon.warn dnsmasq[3844]: possible DNS-rebind attack detected: <domain_name>

Disabling DNS-rebind protection in the router fixes the problem. Is there anything I can do to fix this problem without disabling DNS-rebind protection?

  • 2
    Don't try and access your LAN from within the LAN using it's WAN address, it will confuse the router. – Ƭᴇcʜιᴇ007 Jun 19 '17 at 19:16
  • It is so much more convenient to only have a single set of bookmarks, though! (My use case is accessing several different services on different ports, ergo my need for bookmarks) – user740250 Jun 19 '17 at 20:12
  • You could setup a local host file on your computers within the LAN to use the private IP instead of the public IP, then you could still use your bookmarks. – David Jun 19 '17 at 20:37
3

Your Tomato router is using dnsmaq for resolving DNS queries (actually to forward them to a resolver, but don't mind me).

dnsmasq has a built in protection which you find out. It forbid upstreams resolver to return private IP addresses. You can however fix that only for your use case by using one the --rebind-* option in dnsmasq (see man page), excerpt:

--rebind-localhost-ok
    Exempt 127.0.0.0/8 from rebinding checks. This address range is returned by realtime black hole servers, so blocking it may disable
these services. 
--rebind-domain-ok=[<domain>]|[[/<domain>/[<domain>/]
    Do not detect and block dns-rebind on queries to these domains. The argument may be either a single domain, or multiple domains
surrounded by '/', like the --server syntax, eg.
--rebind-domain-ok=/domain1/domain2/domain3/

In your case, you might want to consider the option --rebind-domain-ok=/domain_name/ (replace domain_name by your domain name).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.