Warnings in syslog re DNS-rebind attack

Setup is main router and dumb AP router. The dumb AP router has "use custom DNS servers" to the main router IP.

Observing these warnings on the main router

daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: dns.msftncsi.com

Looks like MS DNS server.

C:\Windows\System32>nslookup dns.msftncsi.com
Server: OpenWrt.lan
Address: fd4a:11f3:eb17::1

Non-authoritative answer:
Name: dns.msftncsi.com
Address: 131.107.255.255

C:\Windows\System32>tracert -4 dns.msftncsi.com

Tracing route to dns.msftncsi.com [131.107.255.255]
over a maximum of 30 hops:

  • 1 <1 ms <1 ms <1 ms OpenWrt.lan [192.168.1.1]*

Any ideas what is happening and how I could stop the warning - although its not very important.

and

2 Likes