DNS response with IP of private range blocked

rwolfcz · 2024-05-22T10:35:41+00:00

Hello @"Daniele_Sunrise"#7498 and @"pato"#12758, You have discussed in my previous discussion https://community.sunrise.ch/d/27719 about filtering DNS reponses containing private range IP addresses. There is https://nip.io/ service which maps any IP address to hostname, e.g. 10-1-1-1.nip.io returns IP 10.1.1.1. This DNS services works fine from my PC for requests with public IP addresses, but does not work for private range IP requests. Is it maybe security feature against https://en.wikipedia.org/wiki/DNS_rebinding? I presume none will fix this, correct? Thank you. Regards, Robert.

rwolfcz

Hello @Daniele_Sunrise ,

you don’t need Linux to test it! You can make resolution on every system.

On linux or Mac OS X: host 10-0-0-1.nip.io or dig 10-0-0-1.nip.io

On Windows: nslookup 10-0-0-1.nip.io

Only Connect Box is important to be sure, if this is connect box issue or general Sunrise/UPC network issue.

@adrianlondon If you have upc connect box, could you please test resolution of 10-0-0-1.nip.io? It shoud return IP 10.0.0.1. In my home network behind UPC connect box I get no DNS response with private range IP 192.168.x.x or 10.x.x.x or 172.16-31.x.x. I get timeout, which means that the DNS response is not delivered. It does not depend on the DNS server, you can test it with 1.1.1.1 or 8.8.8.8, but for private range, you get no response. If you would have DNS server on other port than 53, then you can DNS repose without any problem (it means, only original DNS port 53 is filtered).

Thank you.

Regards,

Robert.

adrianlondon

Hi Robert,

There’s a lot of info in this thread, and it starts off saying it’s a continuation of another thread. So … I just skipped to your last post 😉

I have the UPC Gigabox and not the Connectbox.

rwolfcz

Hello @adrianlondon ,

thank you for testing. It means, it’s on my Connect Box.

So do you know anyone, is there any possibility to disable this “feature”?

Thank you for your help.

Regards,

Robert.

rwolfcz

Hello @Daniele_Sunrise and @adrianlondon ,

I just have found following discussion https://community.sunrise.ch/d/28059-dns-filtering/6 which is exactly my case. I have the same problem as @yiourkas

Is there really no configuration option to disable this DNS filtering? Is there any possibility to get any other firmware without this filtering? I prefer to have connect box in the router mode because of WLAN AP. I could switch to modem mode, but as I understand, WLAN AP stop working in this mode.

Thank you.

Regards,

Robert.

adrianlondon

Unfortunately, I don’t think Sunrise (or UPC prior) have the interest or technical expertise at their customer-facing departments to fix issues like this.

They will no doubt suggest you switch the Connectbox to modem mode and use all your own equipment (i.e. your own router and access point/s).

I wonder if you could maybe switch to the Gigabox I have? However, maybe my simple nslookup test isn’t enough to prove it’s all working here, so you could end up upgrading your box and still not get anywhere.

yiourkas

@rwolfcz I recommend that you switch to a public DNS server with encryption.

Just search for “DNS over TLS {your operating system}” for how to do it. For Windows 11 / Ubuntu it’s a 1-minute task.

I think it works for most major public DNS servers (1.1.1.1, 8.8.8.8, etc).

In general, using encrypted DNS is more secure. So, win-win!

rwolfcz

@adrianlondon thank you for your hints.

Do you think it would be somehow possible to get the giga connect box? Either first test it or just replace my connect box? I am not sure, if I can just ask support for connect box replace because of this DNS issue. I don’t need something else, connect box works otherwise correctly.

Maybe I run one small device with DHCP and DNS. DHCP will serve itself as DNS and there will be tunnel to my internet server with DNS on different port.

Thank you for this discussion.

Regards,

Robert.

rwolfcz

@yiourkas thank you for your idea. My Problem is on my smart phone. I don’t believe, I can do there something special.

But I will consider DNS over TLS, thank you.

adrianlondon

Do you think it would be somehow possible to get the giga connect box?

Maybe - I’m just a customer 🙂. However, I’m often surprised by how helpful staff such as Daniele can be when it comes to replacing hardware which may (or may turn out not to be) faulty.

Either first test it or just replace my connect box?

I think it takes time to provision a new box so if you get one it’ll be for keeps, as swapping back and forth will be a hassle, and also you may lose internet for a while (few hours? few days?) while the swap takes place. Be warned.

yiourkas

@rwolfcz I am using encrypted DNS on my Google Pixel. I think it can be done in all major Android phones. A quick google search shows me that it can also be done on iPhones.

rwolfcz

@yiourkas oh, is it the private DNS? I found it. I will test it at home. Thank you! 👍️