0

On my DD-WRT router I've been getting these frequent warnings: daemon.warn dnsmasq[2871]: possible DNS-rebind attack detected: dns.msftncsi.com. Some research revealed that the reason for this is that this particular URL resolves to a private IPv6 address. I thought I would stop this by adding the following line to the /tmp/dnsmasq.conf file: --rebind-domain-ok=/.msftncsi.com/ but when I do that DNS seems to stop working and I can no longer reach Internet URLs. What am I doing wrong?

4
  • I'm wondering if the leading dot is the issue. can you specify the subdomain or remove the leading .? May 24 at 19:45
  • The example from my original post is actually a later iteration. I first tried with the full subdomain (dns.msftn.com). Also tried without slashes. No luck - same result.
    – Jerry_D
    May 25 at 12:13
  • is there any particular reason you need to use this DNS server? if it is returning a private IP, then its less than worthless. are you configured to point to it, or is it authorative on a domain you need to lookup frequently? May 25 at 17:06
  • For name resolution I am using Cloudflare DNS (1.1.1.1, 1.0.0.1). The domain dns.msftncsi.com is used by Microsoft Windows as part of it's Network Connectivity Status Indicator tests. This helps Windows determine if the computer is connected to the internet and display the appropriate error icon if connectivity is unavailable. The right thing to do (apart from ignoring the error message) is to whitelist it in dnsmasq but it seems I don't know how to do it.
    – Jerry_D
    May 25 at 19:04

1 Answer 1

0

Just found it! It's such a silly mistake that I feel very ashamed. The line I was adding to the /tmp/dnsmasq.conf file should not have the initial "--" which is only fine if you are adding an option to a command line. Now I took the "--"out and all works as expected. No more false DNS-rebind attack warnings for the Microsoft NCSI function.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.