Trying to use Quad9 with new ASUS RT-AX88U Pro

[Tech9]

Yes they will

Interesting. Why is this even allowed?

 

[RMerlin]

Interesting. Why is this even allowed?

Why not?

I had a customer for which I delegated a sub-domain (lan.domain.com) which contained IP addresses of various VMs within the 10.x.x.x subnet. It made things easier to manage since that customer had over 100 VMs running in the datacenter at the time.

DNSBLs also generally work that way, by returning an IP address within the 127.0.0.x subnet to report whether a specific hostname is blacklisted or not.

 

[Tech9]

This customer with >100VMs in a datacenter relies on an upstream DNS server because it was easier?

 

[ColinTaylor]

Interesting. Why is this even allowed?

There's inherently nothing wrong with that. There's no reason to assume that the router's WAN DNS servers are public servers or what the user's network topology is. Just because the average home user uses something like Google DNS doesn't mean everybody does.

 

[Tech9]

I understand, but we were talking about home router to public DNS like Quad9. This service is not intended for someone running a datacenter, I believe.

 

[ColinTaylor]

I understand, but we were talking about home router to public DNS like Quad9. This service is not intended for someone running a datacenter, I believe.

I've seen Amazon use public DNS records that return private IP addresses for video services. VoIP services also do it sometimes. And of course services like Cloudflare and NextDNS do it when they're blocking certain domains (e.g. porn, malware, etc.). So given that this is perfectly legitimate practice it makes sense that dnsmasq has an option to choose whether of not to accept it.

 

[Tech9]

What's the benefit of enabling it on a home router in this case? Sound like it does more harm than good.

 

[ColinTaylor]

What's the benefit of enabling it on a home router in this case? Sound like it does more harm than good.

DNS rebinding - Wikipedia

en.wikipedia.org

At least Merlin added the option. Whether you use it or not is up to you.

 

[Tech9]

Ah, okay... Wikipedia. Thank you.

 

[ColinTaylor]

Ah, okay... Wikipedia. Thank you.

Sarcasm? Do you have a problem reading Wikipedia?

 

[Tech9]

No. What's your recommendation about this setting in this particular case - home router, Quad9? I believe it has to stay disabled given the fact it's not the only measure on a typical home network using typical home products. Not talking about business firewalls and servers.

 

[ColinTaylor]

No. What's your recommendation about this setting in this particular case - home router, Quad9? I believe it has to stay disabled given the fact it's not the only measure on a typical home network using typical home products. Not talking about business firewalls and servers.

My understanding was that the OP's issue was that he couldn't use Quad9 at all.

 

[RMerlin]

This customer with >100VMs in a datacenter relies on an upstream DNS server because it was easier?

It makes SSH management easier, yes. We had a naming scheme, so we used DNS for what it was intended to: rely on easy to remember names rather than memorizing 100+ IP addresses.

 

[SomeWhereOverTheRainBow]

What's the benefit of enabling it on a home router in this case? Sound like it does more harm than good.

no risks, no rewards.

 

[SomeWhereOverTheRainBow]

It makes SSH management easier, yes. We had a naming scheme, so we used DNS for what it was intended to: rely on easy to remember names rather than memorizing 100+ IP addresses.

This is what I do.

memorizing 100+ IP addresses.

 

[Jonnny]

Yes they will (or at least most of them do). That's the entire point of having the rebind protection option.

So is there any impact on web browsing from being enable?

 

[ColinTaylor]

So is there any impact on web browsing from being enable?

Not normally. Personally, I have it enabled. But if you use a DNS blocking service (like Cloudflare for Families) that returns bogus addresses for blocked domains you may see lots of false warnings in your router's system log.

 

[Jonnny]

Not normally. Personally, I have it enabled. But if you use a DNS blocking service (like Cloudflare for Families) that returns bogus addresses for blocked domains you may see lots of false warnings in your router's system log.

It makes sense what to say, because actually on some devices I have DNS from Cloudflare for Families defined by DNS Director (not for the main network) and several false warnings actually appear. So I deduce that's it.

 

[ColinTaylor]

It makes sense what to say, because actually on some devices I have DNS from Cloudflare for Families defined by DNS Director (not for the main network) and several false warnings actually appear. So I deduce that's it.

If the warnings become too much of an irritation you can either whitelist the specific domain being blocked or globally allow the bogus IP address.

 

[Jonnny]

If the warnings become too much of an irritation you can either whitelist the specific domain being blocked or globally allow the bogus address.

It hasn't bothered me yet, but it's good to know how to ignore these alerts.