1

I have a TP-Link WDR4300 router with OpenWRT BarrierBreaker (vargalex build ver. 1.1.7).

I use due to my Raspberry (SMB, PMA, Plex, etc) DDNS (duckdns.org) to reach my Router outside of my LAN (I've tried to configure VPN on the router, but somehow I can't find the right configuration). My services are using theese ports: 139, 445, 8080, 8081, 8877, 56565 but somewhy 53 (dnsmasq) port is opened from WAN and I can't block it.

netstat outputs:

netstat -an

netstat -an

netstat -pln

netstat -pln

nslookup output:

> server <myremoteaddress>.duckdns.org
Default Server:  remoteconnection.duckdns.org
Address:  <myipaddress>

> google.com.
Server:  <myremoteaddress>.duckdns.org
Address:  <myipaddress>

Non-authoritative answer:
Name:    google.com
Addresses:  xxxx:yyyy:400d:zzzz::200e
          ***.***.72.20
          ***.***.72.34
          ***.***.72.45
          ***.***.72.24
          ***.***.72.49
          ***.***.72.44
          ***.***.72.39
          ***.***.72.25
          ***.***.72.30
          ***.***.72.54
          ***.***.72.40
          ***.***.72.29
          ***.***.72.50
          ***.***.72.59
          ***.***.72.55
          ***.***.72.35

I'm using Google DNS (8.8.8.8, 8.8.4.4).

I've tried to add some rule to block port 53, unsuccessfully...

There are the rules what I've added to the firewall config (/etc/config/firewall) and connected to the desired port:

config rule
    option src 'wan'
    option name 'block_port_53'
    option dest_port '53'
    option target 'REJECT'
    option proto 'all'

config rule
    option target 'ACCEPT'
    option proto 'tcp udp'
    option dest_port '53'
    option name 'Guest DNS'
    option src 'guest'
    option enabled '0'

config rule
    option src 'wan'
    option dest 'lan'
    option name 'restrict_dns_53_lan'
    option dest_port '53'
    option target 'REJECT'

config rule
    option src 'wan'
    option dest_port '53'
    option name 'restrict_dns_forward'
    option target 'REJECT'
    option proto 'tcp udp'
    option dest 'lan'

Guest DNS is currently disabled and it is for the Guest WiFi (it's the Guest DNS zone).

What am I doing wrong?

The main reason to block port 53 is the chinese bots which is trying to rebind my DNS. My router's System Log is full of this:

Jul  4 20:12:53 dnsmasq[2524]: possible DNS-rebind attack detected: 9406151-0-1896986649-4159633587.ns.113-17-184-25-ns.dns-spider.myxns.cn
Jul  4 20:12:53 dnsmasq[2524]: possible DNS-rebind attack detected: 9406163-0-1896986649-4159633587.ns.113-17-184-25-ns.dns-spider.ffdns.net
Jul  4 20:12:53 dnsmasq[2524]: possible DNS-rebind attack detected: 9406153-0-1896986649-4159633587.ns.113-17-184-25-ns.dns-spider.myxns.cn
Jul  4 20:12:54 dnsmasq[2524]: possible DNS-rebind attack detected: 9406166-0-1896986649-4159633587.ns.113-17-184-25-ns.dns-spider.ffdns.net
Jul  4 20:12:54 dnsmasq[2524]: possible DNS-rebind attack detected: 9406154-0-1896986649-4159633587.ns.113-17-184-25-ns.dns-spider.myxns.cn
Jul  4 20:12:54 dnsmasq[2524]: possible DNS-rebind attack detected: 9406157-0-1896986649-4159633587.ns.113-17-184-25-ns.dns-spider.ffdns.net
Jul  4 20:12:54 dnsmasq[2524]: possible DNS-rebind attack detected: 9406156-0-1896986649-4159633587.ns.113-17-184-25-ns.dns-spider.myxns.cn
Jul  4 20:12:54 dnsmasq[2524]: possible DNS-rebind attack detected: 9406148-0-1896986649-4159633587.ns.113-17-184-25-ns.dns-spider.myxns.cn
Jul  4 20:12:54 dnsmasq[2524]: possible DNS-rebind attack detected: 9406149-0-1896986649-4159633587.ns.113-17-184-25-ns.dns-spider.myxns.cn
Jul  4 20:12:54 dnsmasq[2524]: possible DNS-rebind attack detected: 9406155-0-1896986649-4159633587.ns.113-17-184-25-ns.dns-spider.myxns.cn
Jul  4 20:12:54 dnsmasq[2524]: possible DNS-rebind attack detected: 9406160-0-1896986649-4159633587.ns.113-17-184-25-ns.dns-spider.ffdns.net
Jul  4 20:12:55 dnsmasq[2524]: possible DNS-rebind attack detected: 9406164-0-1896986649-4159633587.ns.113-17-184-25-ns.dns-spider.ffdns.net
Jul  4 20:12:55 dnsmasq[2524]: possible DNS-rebind attack detected: 9406158-0-1896986649-4159633587.ns.113-17-184-25-ns.dns-spider.ffdns.net
Jul  4 20:12:55 dnsmasq[2524]: possible DNS-rebind attack detected: 9406150-0-1896986649-4159633587.ns.113-17-184-25-ns.dns-spider.myxns.cn
Jul  4 20:12:55 dnsmasq[2524]: possible DNS-rebind attack detected: 9406161-0-1896986649-4159633587.ns.113-17-184-25-ns.dns-spider.ffdns.net
Jul  4 20:12:55 dnsmasq[2524]: possible DNS-rebind attack detected: 9406147-0-1896986649-4159633587.ns.113-17-184-25-ns.dns-spider.myxns.cn
Jul  4 20:12:55 dnsmasq[2524]: possible DNS-rebind attack detected: 9406152-0-1896986649-4159633587.ns.113-17-184-25-ns.dns-spider.myxns.cn
Jul  4 20:12:56 dnsmasq[2524]: possible DNS-rebind attack detected: 9406162-0-1896986649-4159633587.ns.113-17-184-25-ns.dns-spider.ffdns.net
Jul  4 20:12:57 dnsmasq[2524]: possible DNS-rebind attack detected: 9406159-0-1896986649-4159633587.ns.113-17-184-25-ns.dns-spider.ffdns.net
Jul  4 20:12:58 dnsmasq[2524]: possible DNS-rebind attack detected: 9406165-0-1896986649-4159633587.ns.113-17-184-25-ns.dns-spider.ffdns.net
Jul  4 20:15:24 dnsmasq[2524]: possible DNS-rebind attack detected: 4376755-0-3084195388-824858262.ns.183-213-22-60-ns.dns-spider.ffdns.net
Jul  4 20:15:24 dnsmasq[2524]: possible DNS-rebind attack detected: 4376759-0-3084195388-824858262.ns.183-213-22-60-ns.dns-spider.ffdns.net
Jul  4 20:15:24 dnsmasq[2524]: possible DNS-rebind attack detected: 4376746-0-3084195388-824858262.ns.183-213-22-60-ns.dns-spider.myxns.cn
Jul  4 20:15:24 dnsmasq[2524]: possible DNS-rebind attack detected: 4376741-0-3084195388-824858262.ns.183-213-22-60-ns.dns-spider.myxns.cn
Jul  4 20:15:24 dnsmasq[2524]: possible DNS-rebind attack detected: 4376750-0-3084195388-824858262.ns.183-213-22-60-ns.dns-spider.myxns.cn
Jul  4 20:15:26 dnsmasq[2524]: possible DNS-rebind attack detected: 4376756-0-3084195388-824858262.ns.183-213-22-60-ns.dns-spider.ffdns.net
Jul  4 20:15:26 dnsmasq[2524]: possible DNS-rebind attack detected: 4376752-0-3084195388-824858262.ns.183-213-22-60-ns.dns-spider.ffdns.net
Jul  4 20:15:26 dnsmasq[2524]: possible DNS-rebind attack detected: 4376760-0-3084195388-824858262.ns.183-213-22-60-ns.dns-spider.ffdns.net
Jul  4 20:15:26 dnsmasq[2524]: possible DNS-rebind attack detected: 4376754-0-3084195388-824858262.ns.183-213-22-60-ns.dns-spider.ffdns.net
Jul  4 20:15:26 dnsmasq[2524]: possible DNS-rebind attack detected: 4376758-0-3084195388-824858262.ns.183-213-22-60-ns.dns-spider.ffdns.net
Jul  4 20:15:26 dnsmasq[2524]: possible DNS-rebind attack detected: 4376753-0-3084195388-824858262.ns.183-213-22-60-ns.dns-spider.ffdns.net

Please help me get rid of them.

2
  • Bind the DNS daemon only to a internal interface/to an internal IP address. No need for it to answer requests in the public interface/public IP address. Aug 12, 2016 at 16:01
  • How can I do that? Aug 12, 2016 at 18:25

2 Answers 2

0

Have you tried option proto 'tcpudp'? Both the documentation & how this works in iptables implies this is needed, when you specify port numbers. tcpudp is actually the default. So you don't want to use all or tcp udp (nor udp, as DNS can use both protocols in normal operation).

[openwrt] Match incoming traffic directed at the given destination port or port range, if relevant proto is specified.

[iptables] These extensions can be used if `--protocol tcp' is specified. It provides the following options: ... --destination-port

1
  • Thank you, I'll check it. I hope it will works fine. fingers crossed Aug 12, 2016 at 15:40
0

For anyone looking to do this as of this post, you will need to add the following two lines to the end of your config dnsmasq block in /etc/config/dhcp :

    list interface 'lan'
    list notinterface 'wan'

Example of how it should look like:

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolve.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
        list interface 'lan'
        list notinterface 'wan'

If using Luci, go to Network > General Settings and set Listen interfaces to lan and Exclude interfaces to wan.

Version: OpenWrt 23.05.0 r23497-6637af95aa / LuCI openwrt-23.05 branch git-24.006.68745-9128656

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .