Local IP addresses stripped from DNS response by some home routers

[samgiles]

The names created in this server fail to resolve with the DNS server supplied in the DHCPACK from the BT Home Hub 5:

Succesful resolution bypassing the DHCP supplied DNS server

$ nslookup local.006c824eb59a3422e543d708d2d0a2e576f896b4.box.knilxof.org 8.8.8.8
Server:     8.8.8.8
Address:    8.8.8.8#53

Non-authoritative answer:
Name:   local.006c824eb59a3422e543d708d2d0a2e576f896b4.box.knilxof.org
Address: 192.168.1.67

Fails using the DNS server response from the router configured via DHCP:

.$ nslookup local.006c824eb59a3422e543d708d2d0a2e576f896b4.box.knilxof.org
Server:     192.168.1.254
Address:    192.168.1.254#53

Non-authoritative answer:
*** Can't find local.006c824eb59a3422e543d708d2d0a2e576f896b4.box.knilxof.org: No answer

Routers known to prevent DNS rebinding attacks by stripping local IPs rom responses:

• BT Home Hub 5

[michielbdejong]

Interesting! It works correctly from my coworking space. We should debug as follows:

Your-Laptop:~ You$ ssh [email protected]
ubuntu@ip-172-31-32-55:~$ sudo su
root@ip-172-31-32-55:/home/ubuntu# pm2 logs index

That will stream logs, so you can see what's going on while doing the query. Ping my on irc if you want to pair on this!

[samgiles]

The request doesn't even get to our server :/. I looked yesterday briefly before changing my DNS settings to 8.8.8.8 so I wasn't blocked. I'll do some more debugging when I'm at home next, incidentally, it works with xip.io.

[samgiles]

Ok, thanks to @aosmond for spotting this.

This is because local IP addresses are being stripped out of public DNS responses by some home routers to prevent DNS rebinding attacks.
The only workaround here is to change the DNS settings of the device you use to access the box.

[michielbdejong]

Ouch, that's a problem. It means putting local IP addresses into a public DNS zone will not work for all users. Maybe we can ask plex.tv tech support what their experience is with this in practice. The 'DNS Rebinding' section on https://support.plex.tv/hc/en-us/articles/204604227-Why-can-t-the-Plex-app-find-or-connect-to-my-Plex-Media-Server- seems like it may be related. @samgiles can you try if the instructions from that section solve the problem for your router (replacing 'plex.direct' with 'knilxof.org', of course)?