What do these log entries mean?

Installing and Using OpenWrt
1

Connected to my main router to look at something else and looked at the log and this was immediately obvious as bottom 2 entries after the Luci log in. Can someone tell me what this means please -

Thu Oct  9 21:42:43 2025 daemon.err uhttpd[2007]: [info] luci: accepted login on / for root from 192.168.1.140
Thu Oct  9 21:43:15 2025 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: dev1.nfront.me
Thu Oct  9 21:43:15 2025 daemon.warn dnsmasq[1]: possible DNS-rebind attack detected: dev1.nfront.me

I also had 4 such entries from last night at a similar time?

Secondly whenever I sign into Luci it says “daemon.err” - does that mean an error or short for something else.If an error any idea what as it is not stopping me from accessing Luci?

Apologies if it is covered in a wiki somewhere but I didn’t find it.

2

That whomever runs that domain sux

1 Like
3 
root@OpenWrt:~# nslookup dev1.nfront.me 8.8.8.8
Server:         8.8.8.8
Address:        8.8.8.8:53

Non-authoritative answer:
Name:   dev1.nfront.me
Address: 10.168.128.193

Non-authoritative answer:

10.xxx.xxx.xxx are private IPs. In general practice, public DNS servers shouldn't provide A records with private addresses. This is called DNS Rebinding.

2 Likes
4

Thanks - from that entry it mentions Naver so it is, I believe, something to do with Line - the messaging app.

5

Thanks and apologies but if you have time can you elaborate a little as I am confused.

What exactly is my log entry showing - presume Line is attempting ingress or something but I would expect that and more frequently?

Also any observation on the daemon.err?

Tomorrow I will look up DNS Rebinding but if you or someone can explain a bit I would be grateful.Thanks

6

Domain is ran by South Korean naver internet company if that rings the bell. Probably it is some kind of network condition measurement. dnsmasq acts up correctly.

They have a public dns record pointing to private IP address. That could happen eg. if you are in South Korea and they run some server inside your home providers infrastructure. If you are not in that position just disregard the message and move along.

7

I guess you're saying you still don't understand the 3 lines???

  • You successfully logged into the web GUI
  • I explained above already. These are 2 DNS queries. The reply A record sent as an answer is a private IP address. This is called "DNS Rebind", and OpenWrt blocks DNS Rebind by default for security purposes.
2 Likes
8

I’m moving thank you……

9

Yes so why daemon.err - or does err not denote an error?

Apologies but as mentioned I didn’t understand. I have done some more reading and this sort of clarifies it………

2 Likes
10

It does not denote an error. That is the normal log category.

See: Every cronjob logs an error - #4 by lleachii

I provided more information following that sentence, but glad you found a Palo Alto guide.

Very simply, you don't want public DNS servers providing you replies that contain internal IPs addresses that are not accessible from the public Internet. In most cases, that's a security concern.

1 Like