Control D DNS and possible DNS-rebind attacks

[bbunge]

I have recently noticed another pre loaded DNS service on the Asus firmware. Control D seems to be a "real deal" and has a fancy web site. They have many "free" configuration options.
However, when I select any of the pre loaded DNS options or manually add one of their other services I immediately begin seeing "possible DNS-rebind attack detected:" in the router system log. Going back to Quad9 or Cloudflare and the suspected attacks stop. These "attacks" also happen with DNSSEC or DoT enabled ( I do not use DNSSEC and DoT at the same time).
Is this just me or is there a real problem with Control D DNS?

 

[Tech9]

Most likely your router settings, disable rebind protection. It will generate this log message when upstream service filters something.

 

[bbunge]

Most likely your router settings, disable rebind protection. It will generate this log message when upstream service filters something.

Makes a lot of sense to disable a protection feature that is giving a warning...

Router settings?

Can you explain why this happens on Control D but not on Quad9, CleanBrowsing, Cloudflare, AdGuard, Google and even my ISP default of Level 3? Also happens on Merlin and Asus firmware...

 

[Tech9]

If the filtering server upstream is returning 0.0.0.0 you get the possible rebind attack detected message. I've seen it with Cloudflare and AdGuard, Google and perhaps the ISP have no filtering, don't know about Quad9 and CleanBrowsing. It's a false alarm.

 

[Justinh]

I just started using Control D, and also I see the google of 'possible rebind attacks' msgs. (Quad 9 was giving me too many failures, so I'm trying other services.)

Something from 2022 says that Control D free doesn't support rebind attacks ...

Interesting info from Ctrl D, saying to turn off all the options (in the context of a paid account, I believe)

ASUS Router Guide

📘 DNS Daemon: This router is supported by the ctrld Command Line Daemon . This is the best and simplest way to onboard. ASUS Routers If you have an ASUS router, you will most likely be using one of two different firmware versions: The factory default ASUS router firmware which currently only...

docs.controld.com

 

[bbunge]

I just started using Control D, and also I see the google of 'possible rebind attacks' msgs. (Quad 9 was giving me too many failures, so I'm trying other services.)

Something from 2022 says that Control D free doesn't support rebind attacks ...

Interesting info from Ctrl D, saying to turn off all the options (in the context of a paid account, I believe)

ASUS Router Guide

📘 DNS Daemon: This router is supported by the ctrld Command Line Daemon . This is the best and simplest way to onboard. ASUS Routers If you have an ASUS router, you will most likely be using one of two different firmware versions: The factory default ASUS router firmware which currently only...

docs.controld.com

That Asus router guide has some age to it. Lots has changed with the Asus firmware since that was written. Control D is supposed to have an add-on for Merlin firmware but I suspect it is not current.
As for Quad9, I used to have issues with it when my ISP routed the Anycast address for Quad9 to servers over a thousand miles away. Now it is less than 100 miles. Control D has servers in the same area as Quad9 and Cloudflare and connections to all three are great!

 

[Tech9]

It shows the configuration you need:

 

[bbunge]

It shows the configuration you need:

View attachment 65160

But, did you look at the last step? One setting could get some in trouble...

 

[Tech9]

Steps setting it up look right to me, but I personally don't like layered filtering approach because identifying false positives becomes harder. I would prefer local filtering with unfiltered reliable and local to my location DNS service upstream. This way I know where the issue is if something doesn't work. Simplicity and reliability is the real deal for me.

 

[sfx2000]

possible DNS-rebind attack detected

This is just a warning posted to syslog - just means that a DNS lookup references an address in the RFC1918 space...

Nothing to worry about, IMHO...

 

[bluzfanmr1]

I've been using Control D almost since they started up a few years ago. They are very customer friendly and offer a ton of great customizable services, some for free. I believe one of the main guys there has posted on here before to help solve issues cropping up between Asus routers and Control D. I don't remember exactly what it was, but they were very helpful in solving an issue I had with DoT and my Asus router in the early days. Highly recommend.

 

[EmeraldDeer]

Hmmm, I am not seeing any rebind attack warnings in syslog, even with such warnings enabled on the router

 

[dave14305]

Hmmm, I am not seeing any rebind attack warnings in syslog, even with such warnings enabled on the router

Depends on the Block Response configured in the Control-D portal.

Blocked Query Response (Custom Block Pages)

Customize how Control D responds to blocked queries.

docs.controld.com

 

[EmeraldDeer]

Depends on the Block Response configured in the Control-D portal.

Blocked Query Response (Custom Block Pages)

Customize how Control D responds to blocked queries.

docs.controld.com

I am not a paying customer with an account. I am using one of the free standard profiles which are not configurable. It appears the default blocked query response is NXDOMAIN from /opt/var/log/dnsmasq.log. However, the Control D documentation says that the default response is 0.0.0.0, so I cannot explain. Diversion is configured with NXDOMAIN, so maybe I will see NXDOMAIN when Diversion blocks and 0.0.0.0 when Control D blocks.

 

[FernandoF]

@EmeraldDeer, according to these instructions from Control-D, the DoT servers for their free service are 76.76.2.11 and 76.76.10.11, unlike what is seen in your previous screenshot. Although I suspect that's not the case, I wonder if that may have any impact to the DNS-rebind attack messages.

3. Under the DNS-over-TLS server list, enter your DoT resolver under the “TLS Hostname” section and point the resolver to 76.76.2.22 and 76.76.10.22 if you’re a paid customer and to 76.76.2.11 and 76.76.10.11 if you are using a free resolver.

 

[Justinh]

I've been using Control D almost since they started up a few years ago. They are very customer friendly and offer a ton of great customizable services, some for free. I believe one of the main guys there has posted on here before to help solve issues cropping up between Asus routers and Control D. I don't remember exactly what it was, but they were very helpful in solving an issue I had with DoT and my Asus router in the early days. Highly recommend.

Maybe back then. Now support seems to be Ai-driven as the first layer, no way to get direct contact to a human or ticket system.

 

[Tech9]

I wonder if that may have any impact to the DNS-rebind attack messages.

They are perhaps not getting any filtering with old/wrong settings. @EmeraldDeer, check what's going on there.

 

[Treadler]

@EmeraldDeer, according to these instructions from Control-D, the DoT servers for their free service are 76.76.2.11 and 76.76.10.11, unlike what is seen in your previous screenshot. Although I suspect that's not the case, I wonder if that may have any impact to the DNS-rebind attack messages.

3. Under the DNS-over-TLS server list, enter your DoT resolver under the “TLS Hostname” section and point the resolver to 76.76.2.22 and 76.76.10.22 if you’re a paid customer and to 76.76.2.11 and 76.76.10.11 if you are using a free resolver.

No difference seen here when using the ‘11’ servers, rather than the ‘2’ servers with DoT.

I find any dns using the DoT/dnsmasq of the router to have very high latency. A new page load can take up to 10+ seconds easily. (Cloudflare, Controld, Quad9 all alike in this regard).

Stock or Merlin firmware, no different in this regard.

A stubby issue possibly?

Meanwhile, using an Apple dns profile to use the same servers is blazing fast. (Mostly Apple clients here.)
Added bonus, my ad/malware blocking with a profile is portable, goes with me wherever I go, handy on phone!

I would much prefer to use the router’s facility, but this is where I’m at.

 

[Tech9]

A new page load can take up to 10+ seconds easily.

There is an exact match thread here:

DNS-over-TLS very slow (up to 10 seconds/query) via stubby, fast if queried directly on RT-AC86U

Hey, I recently ran into some trouble with domains not resolving when using DoT on my RT-AC86U. I figured out that this is due to a timeout because the the resolution takes to long. I verified this by trying to query stubby directly on the router: # time nslookup snbforums.com 127.0.1.1...

www.snbforums.com

...and back then you had a fix for this issue.

 

[Treadler]

There is an exact match thread here:

DNS-over-TLS very slow (up to 10 seconds/query) via stubby, fast if queried directly on RT-AC86U

Hey, I recently ran into some trouble with domains not resolving when using DoT on my RT-AC86U. I figured out that this is due to a timeout because the the resolution takes to long. I verified this by trying to query stubby directly on the router: # time nslookup snbforums.com 127.0.1.1...

www.snbforums.com

...and back then you had a fix for this issue.

Good catch! I’ve had a sleep or two since then……
Plus, I don’t think I knew about dns profiles then?

Pixelserv of course is no longer with us. Using a single server with DoT is an improvement, but still way sub par compared with a dns profile.

IMHO, it’s not a server problem, or a Merlin problem, because I have the problem regardless of server, or firmware.

Stubby is the only one left?