Seem to be under attack

Sparkchaser

I was just looking at the router and checked the log and saw this. That’s what I get for opening up the can.

2025 Mar 18 12:06:36 warning dnsmasq: [SYS.4][SYS] possible DNS-rebind attack detected: dns.msftncsi.com
2025 Mar 18 12:06:51 warning dnsmasq: [SYS.4][SYS] possible DNS-rebind attack detected: dns.msftncsi.com
2025 Mar 18 12:07:04 info dnsmasq: [SYS.6][SYS] read /etc/hosts - 4 names
2025 Mar 18 12:07:04 info dnsmasq: [SYS.6][SYS] read /etc/hosts.dnsmasq-dns-lan0 - 9 names
2025 Mar 18 12:07:04 info dnsmasq: [SYS.6][SYS] read /etc/ipv6_hosts - 8 names
2025 Mar 18 12:07:04 info dnsmasq: [SYS.6][SYS] read /etc/ipv4_hosts - 24 names
2025 Mar 18 12:07:04 info dnsmasq: [SYS.6][SYS] read passlist
2025 Mar 18 12:07:04 info dnsmasq: [SYS.6][SYS] read /etc/hosts - 4 names
2025 Mar 18 12:07:04 info dnsmasq: [SYS.6][SYS] read /etc/hosts.dnsmasq-dns-lan0 - 9 names
2025 Mar 18 12:07:04 info dnsmasq: [SYS.6][SYS] read /etc/ipv6_hosts - 8 names
2025 Mar 18 12:07:04 info dnsmasq: [SYS.6][SYS] read /etc/ipv4_hosts - 24 names
2025 Mar 18 12:07:04 info dnsmasq: [SYS.6][SYS] read passlist
2025 Mar 18 12:07:04 info dnsmasq: [SYS.6][SYS] read /etc/hosts - 4 names

There’s a few days worth of the same thing.

cshilton

Sparkchaser 2025 Mar 18 12:06:36 warning dnsmasq: [SYS.4][SYS] possible DNS-rebind attack detected: dns.msftncsi.com
2025 Mar 18 12:06:51 warning dnsmasq: [SYS.4][SYS] possible DNS-rebind attack detected: dns.msftncsi.com

Are you running PfSense or OpnSense on your router? If you are then per this thread: reddit.com, you’ll want to make sure that the hostname on your pfsense box is set correctly. How do I know this? On another thread I talked about renumbering the IPv6 networks behind my Hurricane Electric tunnel. To accomplish this I used a combination of ansible, terraform, and plain old shell over ssh to fix the configuration on the twenty or so affected hosts. A bug in my ansible configuration changed the hostname of one box to something that I recently revived from disuse. My first thought was: “have I been hacked?” A detailed cruise through my ansible inventory files revealed two entries for this box’s IP address, a new one with the correct IPv4 address and an old one that dated from before I initially retired the original user of the IPv4 address.

Rook

Sparkchaser I see the same thing in my router’s “System Log.”
I usually don’t pay much attention to the “info” entries.

For the “Warning” entries I see the same thing about “possible DNS-rebind attack detected…”
These are the only “warning”-level entries on the “System Logging” page (other than in the “Firewall” log).

Sparkchaser I’m not sure I understand what’s happening but it’s been around for awhile.

Same. I googled the issue once and decided not to worry about it.

Sparkchaser

cshilton Are you running PfSense or OpnSense on your router?

Not running anything. It’s as is from Verizon.

FW log is saying this:

[FW] IPTABLES [Pkt_Illegal] IN=eth4 OUT= MAC=b8:f8:53:2e:f9:1f:3e:8a:b0:3d:85:d9:08:00 SRC=45.57.41.1 DST=173.49.78.237 LEN=40 TOS=0×00 PREC=0×00 TTL=61 ID=0 DF PROTO=TCP SPT=443 DPT=53793 WINDOW=0 RES=0×00 RST URGP=0 MARK=0×8000000

px_eliezer_

Might want to cross-post to Security, or else send a message to forum member Hellfire to look at this.

Sparkchaser

px_eliezer_ Might want to cross-post to Security, or else send a message to forum member Hellfire to look at this.

I’ve been looking at it this morning and it seems to be a VZ G3100 router issue. I took every thing offline except the router and they still occur. There are a number of similar complaints in the VZ community forum.
I’m not sure I understand what’s happening but it’s been around for awhile.

So, it doesn’t seem to be a problem. Just that I don’t understand it.

bv1717

px_eliezer_ just wondering does Hellfire work for vz or just knows how to read the router logs better?

px_eliezer_

bv1717 just wondering does Hellfire work for vz or just knows how to read the router logs better?

You’d have to ask him. 🙂

But being that he’s in Canada he probably does not work for Verizon.

Although, as they say….

There’s been a load of compromisin’
On the road to my Verizon.