DNS response with IP of private range blocked

Rrwolfcz · 27 feb 2023

UPC

Connect Box (Compal)

Hello all,

(I am UPC CH customer). Could some please check and confirm, that DNS response with A records with IP from private range are blocked somewhere?

I have my own public zone. At home, I have a few hosts, which I want access using DNS names (not IP addresses) so I have assigned fixed IP on the DHCP (router) and set for them A records with private IPs 192:168.0.x into my DNS zone.

When I request the names from my domain, which have private IPs, I get no answer. It happends when I ask UPC DNS server but even if I ask public DNS servers in internet (1.1.1.1, 9.9.9.9, 8.8.8.8). If I ask any records with public/internet IP, I get correct answer. Funny is, if I make DNAT for port 10053 to e.g. 1.1.1.1:53 on my internet server, then request the DNS name with private IP on my internet host on port 10053, then the answer with private IP comes.

It looks like something is blocking every DNS answer on port 53 which contains IP from private IP range (at least 192.168.0.x). I have tried to deactivate firewalling functionality on my UPC router, but the answer kept blocked.

As workaround I have installed dnsmasq on my internet host on port 10053 and proxy DNS request to other public DNS servers. And on my home hosts I have installed dnsmasq too and for my zone I have configured my internet host with port 10053 as resolver.

I presume this should be some protection agains something, but I don’t really have idea agains what. Or maybe is it some default option of any device, which Sunrise/UPC does use? Would it be possible to deactivate this option and allow DNS resolution containing private IPs?

Thank you.

Regards,

Robert.

Daniele_Sunrise · 28 feb 2023

rwolfcz Welcome to the community!

Your request is very technical. I will ask @pato once for help. Maybe he has an explanation. I would say that NAT loopback does not work on Compal modems.

Greetings
Daniele

Rrwolfcz · 28 feb 2023

Hello Daniele,

thank you for asking pato.

I don’t understand these modems, but from network view, then DNS requests work correctly (i.e. the request for any address goes to destination DNS server).

Then the answers with public IP are delivered back to requesting host.

Only the answers with private IP are somewhere blocked.

Thank you.

Robert.

pato · 28 feb 2023

rwolfcz Daniele_Sunrise This should be some other reason.
I run mine in bridge mode, so I can’t test.

Could you maybe share some results tested with “dig”, you might need to install it first and share the results here? Please run it in the verbose mode.

Rrwolfcz · 28 feb 2023

Hello pato ,

I have created records test-public.mydomain.dom with IP 5.5.5.5 and test-priv-192-168.mydomain.dom with IP 192.168.2.2. On my server I have created simple DNAT on port 53 and 11053 and redirected the DNS queries to DNS server 1.1.1.1:53. I have started tcpdump on my client at home and on the server with DNAT.

Here are the results.

Request test-public.mydomain.dom on the port 53 returns correctly IP 5.5.5.5, on the client and server the request and the response is visible in tcpdump

$ dig -p 53  test-public.mydomain.dom @slave.mydomain.dom
; <<>> DiG 9.16.37-Debian <<>> -p 53 test-public.mydomain.dom @slave.mydomain.dom
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46163
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;test-public.mydomain.dom.          IN      A
;; ANSWER SECTION:
test-public.mydomain.dom.   300     IN      A       5.5.5.5
;; Query time: 28 msec
;; SERVER: IP-SLAVE.MYDOMAIN.DOM#53(IP-SLAVE.MYDOMAIN.DOM)
;; WHEN: Wed Mar 01 00:17:50 CET 2023
;; MSG SIZE  rcvd: 65

#### CLIENT ####
00:17:50.617571 IP 192.168.0.53.48130 > IP-SLAVE.MYDOMAIN.DOM.53: 46163+ [1au] A? test-public.mydomain.dom. (61)
00:17:50.644156 IP IP-SLAVE.MYDOMAIN.DOM.53 > 192.168.0.53.48130: 46163 1/0/1 A 5.5.5.5 (65)

#### IP-SLAVE.MYDOMAIN.DOM ####
00:17:50.630917 IP HOME-IP.48130 > IP-SLAVE.MYDOMAIN.DOM.53: 46163+ [1au] A? test-public.mydomain.dom. (61)
00:17:50.636872 IP IP-SLAVE.MYDOMAIN.DOM.53 > HOME-IP.48130: 46163 1/0/1 A 5.5.5.5 (65)

Request test-public.mydomain.dom on the port 11053 returns correctly IP 5.5.5.5 too, on the client and server the request and the response is visible in tcpdump

$ dig -p 11053  test-public.mydomain.dom @slave.mydomain.dom
; <<>> DiG 9.16.37-Debian <<>> -p 11053 test-public.mydomain.dom @slave.mydomain.dom
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13886
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;test-public.mydomain.dom.          IN      A
;; ANSWER SECTION:
test-public.mydomain.dom.   296     IN      A       5.5.5.5
;; Query time: 40 msec
;; SERVER: IP-SLAVE.MYDOMAIN.DOM#11053(IP-SLAVE.MYDOMAIN.DOM)
;; WHEN: Wed Mar 01 00:17:55 CET 2023
;; MSG SIZE  rcvd: 65

#### CLIENT ####
00:17:55.240128 IP 192.168.0.53.46461 > IP-SLAVE.MYDOMAIN.DOM.11053: UDP, length 61
00:17:55.282346 IP IP-SLAVE.MYDOMAIN.DOM.11053 > 192.168.0.53.46461: UDP, length 65

#### IP-SLAVE.MYDOMAIN.DOM ####
00:17:55.256946 IP HOME-IP.46461 > IP-SLAVE.MYDOMAIN.DOM.11053: UDP, length 61
00:17:55.274641 IP IP-SLAVE.MYDOMAIN.DOM.11053 > HOME-IP.46461: UDP, length 65

Now request private IP. Request test-priv-192-168.mydomain.dom on port 11053 returns correctly the IP 192.168.2.2, and you can see the DNS request and response in tcpdump on client and server:

$ dig -p 11053  test-priv-192-168.mydomain.dom @slave.mydomain.dom
; <<>> DiG 9.16.37-Debian <<>> -p 11053 test-priv-192-168.mydomain.dom @slave.mydomain.dom
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61347
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;test-priv-192-168.mydomain.dom.    IN      A
;; ANSWER SECTION:
test-priv-192-168.mydomain.dom. 276 IN      A       192.168.2.2
;; Query time: 40 msec
;; SERVER: IP-SLAVE.MYDOMAIN.DOM#11053(IP-SLAVE.MYDOMAIN.DOM)
;; WHEN: Wed Mar 01 00:22:50 CET 2023
;; MSG SIZE  rcvd: 71

#### CLIENT ####
00:22:50.190542 IP 192.168.0.53.56017 > IP-SLAVE.MYDOMAIN.DOM.11053: UDP, length 67
00:22:50.229684 IP IP-SLAVE.MYDOMAIN.DOM.11053 > 192.168.0.53.56017: UDP, length 71

#### IP-SLAVE.MYDOMAIN.DOM ####
00:22:50.207458 IP HOME-IP.56017 > IP-SLAVE.MYDOMAIN.DOM.11053: UDP, length 67
00:22:50.221446 IP IP-SLAVE.MYDOMAIN.DOM.11053 > HOME-IP.56017: UDP, length 71

But if I request test-priv-192-168.mydomain.dom on port 53, the client makes request to server, server then sends the response back to client, but the client never gets the response from server:

$ dig -p 53  test-priv-192-168.mydomain.dom @slave.mydomain.dom
; <<>> DiG 9.16.37-Debian <<>> -p 53 test-priv-192-168.mydomain.dom @slave.mydomain.dom
;; global options: +cmd
;; connection timed out; no servers could be reached

#### CLIENT ####
00:22:25.457221 IP 192.168.0.53.45027 > IP-SLAVE.MYDOMAIN.DOM.53: 36624+ [1au] A? test-priv-192-168.mydomain.dom. (67)
00:22:30.455415 IP 192.168.0.53.45027 > IP-SLAVE.MYDOMAIN.DOM.53: 36624+ [1au] A? test-priv-192-168.mydomain.dom. (67)
00:22:35.455231 IP 192.168.0.53.45027 > IP-SLAVE.MYDOMAIN.DOM.53: 36624+ [1au] A? test-priv-192-168.mydomain.dom. (67)

#### IP-SLAVE.MYDOMAIN.DOM ####
00:22:25.475327 IP HOME-IP.45027 > IP-SLAVE.MYDOMAIN.DOM.53: 36624+ [1au] A? test-priv-192-168.mydomain.dom. (67)
00:22:25.486875 IP IP-SLAVE.MYDOMAIN.DOM.53 > HOME-IP.45027: 36624 1/0/1 A 192.168.2.2 (71)
00:22:30.469225 IP HOME-IP.45027 > IP-SLAVE.MYDOMAIN.DOM.53: 36624+ [1au] A? test-priv-192-168.mydomain.dom. (67)
00:22:30.487988 IP IP-SLAVE.MYDOMAIN.DOM.53 > HOME-IP.45027: 36624 1/0/1 A 192.168.2.2 (71)
00:22:35.467271 IP HOME-IP.45027 > IP-SLAVE.MYDOMAIN.DOM.53: 36624+ [1au] A? test-priv-192-168.mydomain.dom. (67)
00:22:35.479780 IP IP-SLAVE.MYDOMAIN.DOM.53 > HOME-IP.45027: 36624 1/0/1 A 192.168.2.2 (71)

You can see, the client makes three DNS requests and server sends three answers with the IP 192.168.2.2, but you don’t see the responses on the client.

I hope the outputs are clear for you. If you don’t understand anything, just ask me, please.

Regards,

Robert.

pato · 1 mar 2023

@Daniele_Sunrise this very much looks like some DNS filtering is done on Sunrise/Router side, which should not happen.

Discussioni relative