Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[pik256]

I purchased a new DIR-845 (EU) and configured it to use at home. I realised that it catch all DNS queries and return answers from DNS set on Internet WAN page. It would be proper behavior on parental control enabled system but I set parental control to "None: Static IP or Obtain Automatically From ISP" and disabled DNS relay at LAN network settings.
Sometimes I need to verify my own DNS from home. It is primary DNS for some domains and I want to check if it is properly configured. But with DIR-845 I cannot: I ask my DNS but allways receive responses from DNS set on the router. I cannot set here my own DNS because it is not recursive, it is only authoritative for several domains.
How can I disable this "feature"? I suspect it could be associated with mydlink cloud because at mydlink I can see last connections (by name) from all LAN machines, thus cloud software watch DNS queries from LAN. But it is completely different behavior: to watch them and or catch them and send to another server. I repeat: parental control and DNS relays are disabled. I set mydlink as well and I cannot see any setting to disable it temporarily.

[FurryNutz]

Link>Welcome!

• Link>What Firmware version is currently loaded? Found on the routers web page under status.

Internet Service Provider and Modem Configurations

• What ISP Service do you have? Cable or DSL?
• What ISP Modem Mfr. and model # do you have?

Do you have custom DNS entered under Setup/Internet/Manual?
Please post a picture of what your seeing:
Adding Screenshots In A Post

[pik256]

• What Firmware version is currently loaded?
• What ISP Service do you have? Cable or DSL?
• What ISP Modem Mfr. and model # do you have?

Do you have custom DNS entered under Setup/Internet/Manual?
Please post a picture of what your seeing:

• The Firmware version is 1.00
  I considered upgrade but this bug is not mentioned on a fix list for 1.02.
• The ISP Service I have is radio line 5GHz
• AFAIK ISP Modem Mfr. I have is MikroTik but I am not sure. They change it occasionally. This is irrelevant to the problem, The proof is below.

Yes, I have custom DNS entered. The answers from DNS depends on settings in this field. When I enter here my own DNS server



and ask it then I receive the following response:

Code: [Select]

Header:
   ID=52001, QR=Response, Opcode=QUERY, RCODE=NO ERROR
   Authoritative Answer=Yes, Truncation=No
   Recursion Desired=No, Recursion Available=Yes
   QDCOUNT=1, ANCOUNT=1, NSCOUNT=2, ARCOUNT=1
Question:
   Name=samekonkrety.pl, QTYPE=A, QCLASS=1
Answer Section:
- Name=samekonkrety.pl
    Type=A, Class=1, TTL=15000 (4 Hours 10 Minutes), RDLENGTH=4
    IP Address=62.181.5.62
Authority Records Section:
- Name=samekonkrety.pl
    Type=NS, Class=1, TTL=15000 (4 Hours 10 Minutes), RDLENGTH=10
    Name Server=ns2.wdc.pl
- Name=samekonkrety.pl
    Type=NS, Class=1, TTL=15000 (4 Hours 10 Minutes), RDLENGTH=18
    Name Server=wdc.sponsor.com.pl
Additional Records Section:
- Name=wdc.sponsor.com.pl
    Type=A, Class=1, TTL=15000 (4 Hours 10 Minutes), RDLENGTH=4
    IP Address=62.181.5.62

This is response partially from my DNS because it is authoritative. Partially, because my DNS do not return Recursion Available flag. But this flag is not used: when I ask for something my DNS is not authoritative then I receive:

Code: [Select]

Header:
   ID=52379, QR=Response, Opcode=QUERY, RCODE=REFUSED
   Authoritative Answer=No, Truncation=No
   Recursion Desired=Yes, Recursion Available=Yes
   QDCOUNT=1, ANCOUNT=0, NSCOUNT=0, ARCOUNT=0
Question:
   Name=forums.dlink.com, QTYPE=A, QCLASS=1

When I enter another DNS, i.e. openDNS here (in fact I use them but they are manually entered, not by parental control):



and ask also MY DNS (62.181.5.62) then I receive the following response:

Code: [Select]

Header:
   ID=51058, QR=Response, Opcode=QUERY, RCODE=NO ERROR
   Authoritative Answer=No, Truncation=No
   Recursion Desired=No, Recursion Available=Yes
   QDCOUNT=1, ANCOUNT=1, NSCOUNT=0, ARCOUNT=0
Question:
   Name=samekonkrety.pl, QTYPE=A, QCLASS=1
Answer Section:
- Name=samekonkrety.pl
    Type=A, Class=1, TTL=0 (), RDLENGTH=4
    IP Address=62.181.5.62

That is not response from my DNS. It is not authoritative. When I ask theoretically my DNS with this setting about a host my DNS should response with RCODE=REFUSED i.e. forums.dlink.com I receive proper response:

Answer Section:
    forums.dlink.com, A, 54.68.115.19

When ask "my DNS" for something what should be blocked by openDNS settings then I receive opendns response:
    ****o.com, A, 67.215.65.130
(IP Address: 67.215.65.130 Hostname: hit-adult.opendns.com)

Hence - DNS queries allways are relayed to servers entered under Setup/Internet/Manual. And even then response is not exactly from DNS because recursion available flag is set by the router.

[FurryNutz]

I notice that your gateway is a private gateway and not a Public IP address as recommended...
If the ISP modem has a built in router, it's best to bridge the modem. Having 2 routers on the same line can cause connection problems: Link>Double NAT and How NAT Works. To tell if the modem is bridged or not, look at the routers web page, Status/Device Info/Wan Section, if there is a 192.168.0.# address in the WAN IP address field, then the modem is not bridged. If the modem can't be bridged then see if the modem has a DMZ option and input the IP address the router gets from the modem and put that into the modems DMZ.

[PacketTracer]

Hi pik256,

it looks like your DIR-845L operates as a kind of "transparent DNS proxy" (using its configured DNS servers), capturing any outgoing DNS query, even those destined  for external DNS servers, and even though you explicitely switched off DNS relay function (which if active should moreover only work for DNS queries sent to the LAN address of the DIR-845L).

According to the (german) manual I also cannot find any other configuration items except those you mentioned, that might have an influence on DNS proxying. Hence, this behaviour either seems to be a "feature" or a bug of the firmware you use.

Maybe using 53/tcp instead of 53/udp for testing your DNS server at 62.181.5.62 might fool your DIR-845L and hence be a workaround. As I can see, your server also replies to 53/tcp (NSLOOKUP mode "vc"):

Code: [Select]

C:\>nslookup
Standardserver:  fritz.box
Address:  fd0d:cf1e:63ee:0:9ec7:a6ff:fe39:d15

> server 62.181.5.62
Standardserver:  wdc.sponsor.com.pl
Address:  62.181.5.62

> set debug
> set vc
> set srchlist=.
> set q=A
> samekonkrety.pl
Server:  wdc.sponsor.com.pl
Address:  62.181.5.62

------------
Got answer:
    HEADER:
        opcode = QUERY, id = 3, rcode = NOERROR
        header flags:  response, auth. answer, want recursion
        questions = 1,  answers = 1,  authority records = 2,  additional = 1

    QUESTIONS:
        samekonkrety.pl, type = A, class = IN
    ANSWERS:
    ->  samekonkrety.pl
        internet address = 62.181.5.62
        ttl = 15000 (4 hours 10 mins)
    AUTHORITY RECORDS:
    ->  samekonkrety.pl
        nameserver = ns2.wdc.pl
        ttl = 15000 (4 hours 10 mins)
    ->  samekonkrety.pl
        nameserver = wdc.sponsor.com.pl
        ttl = 15000 (4 hours 10 mins)
    ADDITIONAL RECORDS:
    ->  wdc.sponsor.com.pl
        internet address = 62.181.5.62
        ttl = 15000 (4 hours 10 mins)

------------
Name:    samekonkrety.pl
Address:  62.181.5.62

> forums.dlink.com
Server:  wdc.sponsor.com.pl
Address:  62.181.5.62

------------
Got answer:
    HEADER:
        opcode = QUERY, id = 4, rcode = REFUSED
        header flags:  response, want recursion
        questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
        forums.dlink.com, type = A, class = IN

------------
------------
Got answer:
    HEADER:
        opcode = QUERY, id = 5, rcode = REFUSED
        header flags:  response, want recursion
        questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
        forums.dlink.com, type = A, class = IN

------------
*** forums.dlink.com wurde von wdc.sponsor.com.pl nicht gefunden: Query refused.
>

PT

[pik256]

Maybe using 53/tcp instead of 53/udp for testing your DNS server at 62.181.5.62 might fool your DIR-845L and hence be a workaround. As I can see, your server also replies to 53/tcp (NSLOOKUP mode "vc"):

Unfortunately not. The router catches both 53/udp and 53/tcp queries.
The workaround I have found is to send queries via VPN connection. This is enough for me so I am not going to risk upgrading firmware.

I notice that your gateway is a private gateway and not a Public IP address as recommended...
If the ISP modem has a built in router, it's best to bridge the modem.

Yes I know it and I have problem with double NAT. But this is my ISP decision and I have no control over it. I would have to pay for a public IP to get rid of double NAT, but I can stand it for the time being.

[FurryNutz]

Any chance you can place the 845L into the ISP modems DMZ? 

[mtztraktoros]

yep, double NAT.
Bridge mode...?

[FurryNutz]

"Yes I know it and I have problem with double NAT. But this is my ISP decision and I have no control over it. I would have to pay for a public IP to get rid of double NAT, but I can stand it for the time being."

yep, double NAT.
Bridge mode...?