Hi, Since the latest Connect Box 3 Fiber firmware update, local connections to my Loxone Smart Home system no longer work on my home network. Before the update, everything worked flawlessly for years. Nothing changed on my side — same devices, same configuration. Remote access via mobile data still works, which isolates the problem to the Sunrise router. **What the update broke:** Loxone devices are reached locally via hostnames like `192-168-x-yy..dyndns.loxonecloud.com`, which resolve to the device's internal IP. This is a standard, RFC-compliant technique used industry-wide (Loxone, Plex, and many other vendors) to enable valid HTTPS certificates for local connections. Since the firmware update, the Connect Box **intercepts all port-53 DNS traffic and silently drops A-record responses containing private IPs** — including queries explicitly directed at third-party resolvers like 8.8.8.8, which the router has no business intercepting or modifying. **Evidence:** 1. From the LAN, A queries time out regardless of which DNS server is queried: $$ nslookup 192-168-x-yy..dyndns.loxonecloud.com 8.8.8.8 DNS request timed out. Name: 192-168-x-yy..dyndns.loxonecloud.com Address: ::ffff:192.168.x.yy $$ 2. The identical A query over DNS-over-HTTPS (`https://dns.google/resolve?name=...&type=A`), which the router cannot intercept, resolves instantly to `192.168.x.yy`. From outside the Sunrise network it also resolves fine. The DNS records are valid and healthy — the Connect Box is discarding legitimate answers in transit. Note that the filtering isn't even consistent: the AAAA record with the IPv4-mapped form (`::ffff:192.168.x.yy`) passes through. So this provides no actual security benefit — it just randomly breaks devices depending on how their OS resolver behaves. As far as I can tell, the Connect Box offers no setting to disable this filtering and no option to configure custom DNS servers — so I haven't found any clean way to get local access working again since the update. **Question: Is there any workaround or solution for this?** For example a hidden setting to disable the DNS filtering, a whitelist for domains like dyndns.loxonecloud.com, a way to stop the router from intercepting queries to third-party resolvers, or a planned firmware fix/rollback? This all worked before the update, so I'm hoping Sunrise can restore the previous behavior or at least point me to an official workaround. Thanks!

Connect Box 3 Fiber seems to intercept DNS

GoingForGold

Hi,
Since the latest Connect Box 3 Fiber firmware update, local connections to my Loxone Smart Home system no longer work on my home network. Before the update, everything worked flawlessly for years. Nothing changed on my side — same devices, same configuration. Remote access via mobile data still works, which isolates the problem to the Sunrise router.

What the update broke: Loxone devices are reached locally via hostnames like 192-168-x-yy.<serial>.dyndns.loxonecloud.com, which resolve to the device’s internal IP. This is a standard, RFC-compliant technique used industry-wide (Loxone, Plex, and many other vendors) to enable valid HTTPS certificates for local connections. Since the firmware update, the Connect Box intercepts all port-53 DNS traffic and silently drops A-record responses containing private IPs — including queries explicitly directed at third-party resolvers like 8.8.8.8, which the router has no business intercepting or modifying.

Evidence:

From the LAN, A queries time out regardless of which DNS server is queried:

$$
nslookup 192-168-x-yy.<serial>.dyndns.loxonecloud.com 8.8.8.8
DNS request timed out.
Name: 192-168-x-yy.<serial>.dyndns.loxonecloud.com
Address: ::ffff:192.168.x.yy
$$

The identical A query over DNS-over-HTTPS (https://dns.google/resolve?name=...&type=A), which the router cannot intercept, resolves instantly to 192.168.x.yy. From outside the Sunrise network it also resolves fine. The DNS records are valid and healthy — the Connect Box is discarding legitimate answers in transit.

Note that the filtering isn’t even consistent: the AAAA record with the IPv4-mapped form (::ffff:192.168.x.yy) passes through. So this provides no actual security benefit — it just randomly breaks devices depending on how their OS resolver behaves.

As far as I can tell, the Connect Box offers no setting to disable this filtering and no option to configure custom DNS servers — so I haven’t found any clean way to get local access working again since the update.

Question: Is there any workaround or solution for this? For example a hidden setting to disable the DNS filtering, a whitelist for domains like dyndns.loxonecloud.com, a way to stop the router from intercepting queries to third-party resolvers, or a planned firmware fix/rollback? This all worked before the update, so I’m hoping Sunrise can restore the previous behavior or at least point me to an official workaround.

Thanks!

Daniele_Sunrise

GoingForGold Welcome to the community!

Unfortunately, I’m not tech-savvy enough to give you an answer. But I’m assuming you’ve received the new firmware that enabled Dual Stack, which doesn’t allow you to disable IPv6 DHCP.

Maybe other users who have a fiber modem will chime in and be able to answer your questions.

But if I’m seeing it correctly, have you disabled the firewall on the modem for both IPv4 and IPv6? Would there be any problem with putting your firewall in the DMZ and then trying again?

Greetings
Daniele

GoingForGold

Thanks for your reply Daniele! I did deactivate the firewall in the modem for both IPv4 and IPv6, it did not change anything unfortunately.

Daniele_Sunrise

GoingForGold Our modem team has now disabled the DNS Rebind Protection feature as a test. Could you please try again to see if it works now? Please do not reset the modem, as this will reactivate the feature.

Greetings
Daniele

GoingForGold

Hi Daniele, thank you! In fact, it DID start to work again! I am not sure when exactly, but I did notice it yesterday (Sunday). Would be awesome if it could stay like this 🙂

Daniele_Sunrise

GoingForGold We activated the feature on Thursday 23 July 26 at 2.22 pm. I’ll pass on your feedback straight away, as our modem team would like to include this feature in future firmware updates.

Greetings
Daniele

GoingForGold

Awesome! Is there a rough timeline until when this can be included as a regular feature? Are we talking days, weeks, months?

Daniele_Sunrise

GoingForGold Unfortunately, no—we’ll first present your suggestion. It will then be reviewed and analyzed, and if appropriate, included in a firmware update. But that might take a while.

Greetings
Daniele