This topic

Do BT routers block DNS which resolve to private IPs

AntonyScerri — Wed, 20 Oct 2021 16:00:18 GMT

Been trying to find a definitive answer to this. Basically some host names are configured with private IPs and these do not appear to resolve over the home network going through a BT router. Switching to a mobile hotspot they are fine. Also querying the BT name servers (taken from the routers current config) directly works fine as well it only seems to be when it trying to resolve against the router. The IP in this case was a 10.x.x.x. I'm not expecting anyone to be able to reach this over the internet etc, its a managed service which is simply pushing the host name with internal IP but the routing is setup correctly. This is only effecting some users, so far that appears to be BT users in the UK and we have a similar situations with an ISP in the US. For now we are just switching to Google DNS but would like to pin point the cause of these DNS failures to rule out anything else. Anyone aware of any documentation describing this behaviour?

Tony

Re: Do BT routers block DNS which resolve to private IPs

licquorice — Wed, 20 Oct 2021 16:10:34 GMT

DNS can't resolve host names to private address ranges directly, it can only resolve them to public IP addresses which are then in turn forwarded to the private address. The whole point of private addresses is that they aren't routable.

Re: Do BT routers block DNS which resolve to private IPs

AntonyScerri — Wed, 20 Oct 2021 16:24:13 GMT

Sorry I believe you are confusing routing with name resolution. DNS is quite capable of returning private IP addresses.

Re: Do BT routers block DNS which resolve to private IPs

licquorice — Wed, 20 Oct 2021 16:42:54 GMT

@AntonyScerri wrote:

DNS is quite capable of returning private IP addresses.

To what purpose?

Re: Do BT routers block DNS which resolve to private IPs

AntonyScerri — Wed, 20 Oct 2021 17:02:29 GMT

So not the exact reason in this case BUT when you have a FQDN on a network which uses those private IP addresses the DNS will server them up in response to a lookup on that name.

I understand there is a long running debate about whether private IPs should be surfaced via public DNS or not. However I'm just trying to identify the point at which things are being cut off. From everything I can tell as in my original post the name servers like Google's happily return the private IP, as does the BT name servers (eg 81.139.57.100), however the BT SmartHub routers which is configured to use that (BT) name server but promotes its self as the local DNS server on your home network will not return the entry.

I'm just trying to get some definitive confirmation this is a deliberate filtering done on the BT routers.

Re: Do BT routers block DNS which resolve to private IPs

licquorice — Wed, 20 Oct 2021 17:40:33 GMT

@AntonyScerri wrote:

So not the exact reason in this case BUT when you have a FQDN on a network which uses those private IP addresses the DNS will server them up in response to a lookup on that name.

Ok, but only accessible to that network

I understand there is a long running debate about whether private IPs should be surfaced via public DNS or not. However I'm just trying to identify the point at which things are being cut off. From everything I can tell as in my original post the name servers like Google's happily return the private IP, as does the BT name servers (eg 81.139.57.100), however the BT SmartHub routers which is configured to use that (BT) name server but promotes its self as the local DNS server on your home network will not return the entry.

I guess the router is trying to use its local DNS server to resolve the hostname somehow but won't have an A record. Not sure why it would do that though.

I'm just trying to get some definitive confirmation this is a deliberate filtering done on the BT routers.

Not sure you will get a definitive answer here as this is basically a customer to customer self help forum. I'll flag this to the mods to see if they can elicit any expert help.

Re: Do BT routers block DNS which resolve to private IPs

AntonyScerri — Wed, 20 Oct 2021 17:52:15 GMT

Exactly its a bit of a tangle but something is filtering it out somewhere 🙂

I'm checking via multiple avenues to try and get to the bottom of it, if you can bump it here just in case that would be great.

Re: Do BT routers block DNS which resolve to private IPs

WSH — Wed, 20 Oct 2021 18:45:10 GMT

It’s unclear what you are trying to achieve here.

“…long running debate about whether private IPs should be surfaced via public DNS or not”. Common sense should suggest that this is because they are not unique on the Internet, so how is a remote DNS server to resolve an address that exists in multiple locations?

“From everything I can tell as in my original post the name servers like Google's happily return the private IP, as does the BT name servers (eg 81.139.57.100),”…81.139.57.100 is not a private address. I suspect your real problem is NAT rather than DNS.

Re: Do BT routers block DNS which resolve to private IPs

AntonyScerri — Wed, 20 Oct 2021 19:23:21 GMT

The host name is unique that is what is being looked up by a DNS request. The IP returned may well not be unique, and isnt so for many valid reasons, this is not the problem.

The IP Address I gave 81.139.57.100 is one of BT's name servers which you can direct DNS requests to. If you query this for a domain which returns a private IP it will return the records. As will Google's. If however you use the default automatic network configuration provided by the BT router, it will configure your dns server as the router, which when queried will not return the record, making it seem the domain name does not exist. I'm trying to find out what is blocking that particular response, as it seems to be the router.

Re: Do BT routers block DNS which resolve to private IPs

ninebolts — Mon, 14 Mar 2022 18:46:49 GMT

I'm having the same issue and would prefer not to have to hardcode DNS servers.

I have networks of machines which have public and private addresses and are situated in the cloud. I frequently need to refer to them by their private address scheme. I'm using 172.16.0.0/16 subnets

For example I have ssh config rules that based on IP network or DNS name will push the connection through a bastion or specific VPN.

As mentioned by the OP the router flies in the face of convention and fails to resolve. BTs own DNS or the google servers will resolve the same request.

What if I want to have a valid DNS name given to a local resource on my internal house network. There is no reason why that name shouldn't be usable but the router is blocking it.

Re: Do BT routers block DNS which resolve to private IPs

hmm3 — Mon, 22 Aug 2022 21:12:04 GMT

So after a really frustrating time trying to deal with this tonight I've settled on a workaround which might work for some cases. Not sure if it would help in your case @ninebolts

In my case I changed it to be a cname of a "hostname.home" instead, which then the BT router handles the A record of to get around this filtering.

I understand this may be a sensible default, and protects against some dns rebinding attacks, is why I assume its implemented. But to not have the ability to reconfigure this, nor the ability to reconfigure DHCP to point to alternative DNS servers is a really crappy and disappointing situation.

Re: Do BT routers block DNS which resolve to private IPs

chandler3224 — Tue, 23 Aug 2022 14:17:38 GMT

@licquorice wrote:
To what purpose?

Certainly for the business I work for we have domains that loop back to internal servers to ease software development. We have a domain resolving to a local IP as well as a domain resolving to an internal test server.

I have the same issues as OP as well as @ninebolts and @hmm3 . I am trying to resolve to a 172.20 address but it does seem that BT filter out reserved IPs. I did ask BT support but they suggested to raise a complaint to get someone to confirm whether this is the case, so currently I've got an open complaint.

@hmm3 you mention that you have a cname of hostname.home. I assume this is something you've set up locally? Could you elaborate on this a bit more?

Re: Do BT routers block DNS which resolve to private IPs

hmm3 — Thu, 25 Aug 2022 13:47:54 GMT

Sure, at a glance, judging by your IP ranges this isn't going to be remotely helpful, apologies. And as I've continued to test it even has its own quirks and inconsistencies! It will also not work for companies trying to support mutiple end users, or anything like that. It works for me, in my home.

So what I mean is my hub will assign the hostname given on dhcp it's own A record, lets say, for the sake of example "kubernetes.home". So if it's getting its address from the homehub DHCP I can point "kubernetes.hmmm3.com" CNAME to "kubernetes.home" and the homehub will resolve it to, lets say 192.168.1.253, because it's doing the resolution itself for the A record.

What I've actually found in testing this is pretty incredible, it seems to be if the client queries the DNS server by its ipv6 address, then the query won't return anything even from the HH. I don't recall seeing anything in the RFC about handling records differently on this front, but I admit- it has been a while. Still looking into it if its the real root cause but some quick manual testing seems to suggest it might be. So this might end up with me disabling IPv6 as well in the HH, which is a massive shame because that was an annoyance with my last provider!

If the client calls it by ipv4 address then it will lookup "kubernetes.hmmm3.com", find the "kubernetes.home" CNAME and lookup the A record from the home hub itself, which is successfully returned.

This would all go away if we could configure alternative DNS servers given in DHCP, of if this behaviour could be disabled. Behaviours that break RFC's should at least be configurable, and I shouldn't need to manage DHCP manually on each device. It's incredibly frustrating. I get that it's not a problem that affects 95+% of people but it is broken.

If you get any news from your complaint @chandler3224 , I would love to hear back.

Re: Do BT routers block DNS which resolve to private IPs

chandler3224 — Thu, 25 Aug 2022 13:51:22 GMT

Ah brilliant, thanks for the info. That's a clever solution but unfortunately it won't help in my case as we have users who aren't on BT as well.

As for the complaint, I had a notification yesterday that it's been closed with no extra detail. Just straight up closed. I'm going to call today/tomorrow and ask for an update but I'm not getting my hopes up.

Re: Do BT routers block DNS which resolve to private IPs

licquorice — Thu, 25 Aug 2022 14:21:05 GMT

You have to remember the home hub is a mass produced ISP supplied device that is going to be locked down and plug and play for the 99% of the customer base that have no need to change any settings. Anybody wishing something more configurable is likely to be using a third party router.

Re: Do BT routers block DNS which resolve to private IPs

hmm3 — Thu, 25 Aug 2022 17:43:28 GMT

I completely understand that perspective and I generally agree but that's my particular issue here, if you make something that just works, it does need to work!

It's far more reasonable to expect people to be able to configure something than fault find undocumented network breaking behaviours - even if it were to be remotely reset before support are willing to hop on a call about other issues?

If you make something that goes and breaks standards then that's where good documentation and configuration really should, in my opinion, have to be in place. I'd be happy to be corrected if public DNS resolving private IP addresses isn't standard and that it's other DNS servers that are the issue, but nothing and no RFC I have seen supports that so far.

The only logical reason I can see for this is to protect users from DNS rebinding attacks. But its a massively disproportional response to a really minor threat. Especially when steps aren't being taken to block, say, known malicious domains!

Re: Do BT routers block DNS which resolve to private IPs

hmm3 — Thu, 25 Aug 2022 20:26:44 GMT

Feel free to cut me off here- obviously it's none of my business whatsoever, but what is your setup like?

Just thinking if its a point to point VPN to servers you control its probably going to be easier to just push alternative DNS servers as at the point of the connection, even if they're just Google's.

If its a VM host internal network, for Windows and if they're devices under your control you could maybe roll out NRPT rules instead and point them to a VM, Google's server, or your own for that domain. Or even just roll a hosts file to the developers via GPO (bit gross though!). Not sure about other OS's, or if you have a BYOD type thing going on.

Easier than battling multiple ISP's or rolling out your own routers for everyone, I'm thinking. Though whatever the case, I appreciate your raising of a complaint.

Re: Do BT routers block DNS which resolve to private IPs

chandler3224 — Fri, 26 Aug 2022 08:29:36 GMT

@hmm3 You're totally right! Pushing it through the VPN setup is the way to go however it seems that the VPN software the company uses is old, very old, and doesn't set the DNS correctly. It's something I'm working with them with but I was trying to tackle it from two different angles.

I didn't initially aim to raise a complaint. I just wanted to find out whether the BT DNS blocked internal IPs seeing as an official response would have backed my case. However, as I mentioned, BT support have closed the complaint without any sort of reply.

We've resorted to setting the DNS to Google DNS IPs for those who are affected as we're not always connected to the VPN. Not ideal but does the job.

I appreciate the help though, thanks!