Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I have a dd-wrt router with DNSmasq functioning as the DNS server for local hosts. DNSmasq resolves external domains using Google DNS (8.8.8.8/8.8.4.4). With this setup, domain names like 192.168.X.X.xip.io and 127.X.X.X.xip.io won't resolve, and I believe there is something wrong with my DNSmasq setup. Anyone else ran into similar issues?

(Update) Problem solved by myself. The DNSmasq config has stop-dns-rebind option enabled, which filters out DNS results in private IP ranges from upstream servers for security reasons. DNSmasq doc has the following part:

    -stop-dns-rebind
Reject (and log) addresses from upstream nameservers which are in the private IP ranges. This blocks an attack where a browser behind a firewall is used to probe machines on the local network.

In case you run into this issue, just comment out this option in dnsmasq.conf and restart dnsmasq.



Or you can add rebind-domain-ok=xip.io to dnsmasq.conf. Not that I would do that myself, as I still don't see what value it provides.


Thanks for this tip! I guess this is more secure than just opening up all rebind from the wild.


I run unbound as my recursive DNS resolver and it too strips those results out for security purposes.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: