ItzTrain
Electronic Eel@train they will be blocked by DNS rebind protection when you try to resolve them. So I don't think it is a good idea
@electronic_eel Wait what!! Speak the english!!
Tuhgy@train @electronic_eel Copied from the dnsmasq manpage:
Reject (and log) addresses from upstream nameservers which are in the private ranges. This blocks an attack where a browser behind a firewall is used to probe machines on the local network. For IPv6, the private range covers the IPv4-mapped addresses in private space plus all link-local (LL) and site-local (ULA) addresses.This is the way OpenWrt works by default.@train @electronic_eel It can be configurable. It depends entirely on your setup. For example in OPNsense there's a toggle here: https://docs.opnsense.org/manual/settingsmenu.html#web-gui
Look for "DNS Rebind Check".
Look for "DNS Rebind Check".
@electronic_eel @train That's actually very interesting, I just read https://en.wikipedia.org/wiki/DNS_rebinding#How_DNS_rebinding_works
@tuhgy @electronic_eel So I'm trying to contextualize the security implications of this on a home network. Is this like you on some tin foil hat type stuff. Yes technically is a security concern, but you doing way to much! Or this has some heft to it and you probably should use this.
@train @tuhgy difficult to say. The attack vector is well known for years, the required infra & code not very difficult. so someone pulling this off is not unreasonable. You just need a widespread kind of vulnerable device on common local IPs that makes mass attacks pay off. But I haven't seen actual attacks or heard of them.
So I think setting up protection against it is a good idea, also because it is easily done on many router platforms.
@electronic_eel @tuhgy Solid! Thank you!!
@train @electronic_eel I personally use split-dns, or don't even use external DNS and only provide it for subdomains. However Pi-hole does have a suggestion to disable rebind protection. And there's Netgate that says to add an exclusion for specific domains: https://docs.netgate.com/pfsense/en/latest/services/dns/rebinding.html
@train @electronic_eel Also NextDNS does not have it enabled by default: https://help.nextdns.io/t/35hmval/what-is-dns-rebinding-protection