Hostnames prefixed with customer.oowvps.co

Installing and Using OpenWrt
1

Hello everyone and happy new year

for some reason my hosts are now showing their domain suffixed with customer.oowvps.com

in spite of using a DHCP domain definition this is being ignored ?

note that the hosts are not mobile phones !

Thank you

2

Which device are you using and which LEDE / OpenWrt firmware image?

3

WRT3200acm; Lede snapshot r5682-b153dbf046

4

Please provide your /etc/config/dhcp file

5 
config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option nonwildcard '1'
        option localservice '1'
        option local '/xxxxx.com/'
        option domain 'xxxx.com'
        option dnssec '1'
        option dhcpleasemax '30'
        option nonegcache '1'
        option dnsforwardmax '200'
        option cachesize '200'
        option allservers '1'
        option noresolv '1'
        option strictorder '1'
        list server '127.0.0.1#5353'
        list server '127.0.0.1#5354'
        list server '127.0.0.1#5355'
        list server '/pool.ntp.org/8.8.8.8'
        list notinterface 'wan'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option dhcpv6 'server'
        option ra 'server'
        option leasetime '6h'
        option ra_management '1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'
6

Would those 2 snippled domains happen to be: customer.oowvps.com???

7

nope .... just masked ... what is not happening is that the dhcp leases are not suffixed with this domain but instead with this customer.oowvps.com

8

This command tells your DNS server to use a different forwarders for a given domain. Why???

Upstream DNS servers (and how DHCP hands them out) are likely listed under: /etc/config/network

It's likely your upstream DNS is poisoning local or NXDOMAIN responses.

9

these are statement included by dnscrypt .. .at the moment I have three... you are right ...meaning that dnscrypt proxies are poisoned :wink:

10

You never mentioned you're running DNSCrypt...

And yes, the proxies could be poisoned. If someone is running a DNSCrypt server on a consumer connection for example, their upstream DNS provider (usually the ISP) could be poisoning nonexistent Global results to point to their domain.

Try running nslookup on the upstream DNS servers (if they have normal lookup available)...and see if their response is in the customer.oowvps.com domain.

  • ALSO CONFIRM THAT YOU DO NOT SPECIFY DNS SERVERS ON THE WAN INTERFACE - NOR CONFIGURE YOUR DEVICE TO GET DNS SERVERS VIA DHCP!
11

yes - I am using "list notinterface ‘wan’"
and also the following
config dhcp 'wan’
option interface 'wan’
option ignore ‘1’

in fact they are resolving to google ... somehow I can't change the domain for mobile/android devices

Anyhow - thank you for everyone's help