[dns-operations] simple dns rebinding protection with dnsmasq (fwd)

Gadi Evron ge at linuxbox.org
Thu Feb 28 01:19:24 UTC 2008

---------- Forwarded message ----------
Date: Mon, 22 Oct 2007 20:05:06 +0200
From: Collin R. Mulliner <collin at betaversion.net>
To: full-disclosure at lists.grok.org.uk, bugtraq at securityfocus.com
Subject: simple dns rebinding protection with dnsmasq

dnsmasq (http://www.thekelleys.org.uk/dnsmasq/doc.html) a popular DHCP
and DNS forwarder and cache server used on many DSL/Cable routers now
has a simple DNS Rebinding protection mechanism. When executed with the
--stop-dns-rebind option the DNS resolver in dnsmasq will filter out
private IP addresses (,,, and This should be sufficient for most
private/home users.

Feedback welcome.


dnsmasq with dns rebinding protection:

orginal patch:


Collin R. Mulliner <collin at betaversion.net>
BETAVERSiON Systems [www.betaversion.net]
info/pgp: finger collin at betaversion.net
weblog: http://www.mulliner.org/blog/
Tabs are for indentation space is for astronauts.

More information about the dns-operations mailing list