DNS Rebind Attack Alerts

[SMS786]

The following alert was posted over a hundred times in my syslog during a span of the last 24 hours:

Apr 20 20:06:54 dnsmasq[288]: possible DNS-rebind attack detected: httpconfig.vonage.net
Apr 20 20:07:00 dnsmasq[288]: possible DNS-rebind attack detected: httpconfig.vonage.net
Apr 20 20:07:00 dnsmasq[288]: possible DNS-rebind attack detected: httpconfig.vonage.net

I have a vonage voip box that is connected to my 68U through ethernet running the latest 384.16. I also have had "dns rebind protection" enabled under WAN settings for a while now, but these alerts just started popping up today. Should I be concerned?

 

[RMerlin]

That's because that hostname resolves to a non-public IP, triggering dnsmasq's rebind protection. Either disable that protection, ignore it, or tell dnsmasq to ignore that domain through a dnsmasq.conf.add script.

rebind-domain-ok=httpconfig.vonage.net

 

[SMS786]

That's because that hostname resolves to a non-public IP, triggering dnsmasq's rebind protection. Either disable that protection, ignore it, or tell dnsmasq to ignore that domain through a dnsmasq.conf.add script.

rebind-domain-ok=httpconfig.vonage.net

Thank you. Added the exception to my dnsmasq script file and now all is well.