Log flood by dnsmasq

[lawk]

Hi,

My log is constantly being flooded with this message, once a second:

dnsmasq[22041]: LOUD WARNING: use --bind-dynamic rather than --bind-interfaces to avoid DNS amplification attacks via these interface(s)
dnsmasq[22041]: LOUD WARNING: listening on 213.XXX.218.XX may accept requests via interfaces other than eth0

I only edited my public ipv4 for privacy. Any idea what could be causing it?

 

[bbunge]

Hi,

My log is constantly being flooded with this message, once a second:

dnsmasq[22041]: LOUD WARNING: use --bind-dynamic rather than --bind-interfaces to avoid DNS amplification attacks via these interface(s)
dnsmasq[22041]: LOUD WARNING: listening on 213.XXX.218.XX may accept requests via interfaces other than eth0

I only edited my public ipv4 for privacy. Any idea what could be causing it?

Router model and firmware please.

 

[lawk]

RT-AX88U Pro, 3.0.0.6.102_21514

I think I found the cause:

it happens when "Advertise router's IP in addition to user-specified DNS" is enabled.

It still does it with that option disabled.

I tried something else now, let the WAN default DNS from ISP as enabled.

for now the messages are gone.

So this keeps happening. After all.

 

[lawk]

Maybe it is because I am running bind9 on dmz server, will check that

 

[dave14305]

dnsmasq is warning you that it is listening on an interface with a public IP. Whats the output of this command, run on the router over SSH?

grep -E "bind|interface" /etc/dnsmasq.conf

I don’t think anyone knows what the new Asus source code looks like yet, but this seems unusual, compared to past releases.

My config from Merlin 388 firmware shows:

# grep -E "bind|interface" /etc/dnsmasq.conf
bind-dynamic
interface=br0
interface=pptp*
no-dhcp-interface=pptp*
interface=br1
interface=br2

 

[lawk]

bind-interfaces
interface=br0
interface=eth0
no-dhcp-interface=tun22
no-dhcp-interface=tun23
interface=wgs1
no-dhcp-interface=wgs1

 

[dave14305]

That’s pretty wild that it explicitly adds the wan interface. Do you run a IPsec VPN server / Instant Guard?

 

[lawk]

I did run IPSec but turned it off, I run Wireguard.

I will try with wireguard turned off.

 

[lawk]

Yeah with wireguard turned off it stops.