On my DD-WRT router I've been getting these frequent warnings: daemon.warn dnsmasq[2871]: possible DNS-rebind attack detected: dns.msftncsi.com. Some research revealed that the reason for this is that this particular URL resolves to a private IPv6 address. I thought I would stop this by adding the following line to the /tmp/dnsmasq.conf file: --rebind-domain-ok=/.msftncsi.com/ but when I do that DNS seems to stop working and I can no longer reach Internet URLs. What am I doing wrong?
-
I'm wondering if the leading dot is the issue. can you specify the subdomain or remove the leading .?– Frank ThomasCommented May 24, 2022 at 19:45
-
The example from my original post is actually a later iteration. I first tried with the full subdomain (dns.msftn.com). Also tried without slashes. No luck - same result.– Jerry_DCommented May 25, 2022 at 12:13
-
is there any particular reason you need to use this DNS server? if it is returning a private IP, then its less than worthless. are you configured to point to it, or is it authorative on a domain you need to lookup frequently?– Frank ThomasCommented May 25, 2022 at 17:06
-
For name resolution I am using Cloudflare DNS (1.1.1.1, 1.0.0.1). The domain dns.msftncsi.com is used by Microsoft Windows as part of it's Network Connectivity Status Indicator tests. This helps Windows determine if the computer is connected to the internet and display the appropriate error icon if connectivity is unavailable. The right thing to do (apart from ignoring the error message) is to whitelist it in dnsmasq but it seems I don't know how to do it.– Jerry_DCommented May 25, 2022 at 19:04
Add a comment
|
1 Answer
Just found it! It's such a silly mistake that I feel very ashamed. The line I was adding to the /tmp/dnsmasq.conf file should not have the initial "--" which is only fine if you are adding an option to a command line. Now I took the "--"out and all works as expected. No more false DNS-rebind attack warnings for the Microsoft NCSI function.