Genius WAN DNS resolution

Forums › 2degrees (including Slingshot, Orcon, Flip, Stuff Fibre, MyRepublic, 2talk and Vocus) › Genius WAN DNS resolution

sbiddle

30853 posts

Uber Geek
+1 received by user: 9998

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#115545 29-Mar-2013 08:56

I was just doing some testing for somebody and noticed their Genius has DNS resolution enabled on the WAN interface meaning I can browse the web using somebody's Orcon IP. Is this the standard setup for all Genius devices? If so it's no wonder the internet is being flooded with so many DNS DDoS attacks..

OldGeek

993 posts

Ultimate Geek
+1 received by user: 410

ID Verified

Lifetime subscriber

#789138 29-Mar-2013 10:40

Orcon publish their DNS servers here http://www.orcon.net.nz/support/gfaq_page/what_are_your_dns_server_addresses and presumably these servers can only be used by users logged on to their network. If I was Orcon I would be concerned only if non-Orcon users could use these servers. My apologies if I have misunderstood your post.

sbiddle

30853 posts

Uber Geek
+1 received by user: 9998

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#789141 29-Mar-2013 10:48

OldGeek: Orcon publish their DNS servers here http://www.orcon.net.nz/support/gfaq_page/what_are_your_dns_server_addresses and presumably these servers can only be used by users logged on to their network. If I was Orcon I would be concerned only if non-Orcon users could use these servers. My apologies if I have misunderstood your post.

The Orcon DNS servers won't resolve queries if you're outside the Orcon network. This is standard practice for an ISP these days.

The issue I've seen is individual Genius devices responding to DNS queries (at least the one device I tested), ie browsing the net using a DNS IP address of an Orcon customer which means they'll be stung traffic usage for these DNS requests. There are lots of poorly configured devices out there like this, and in the past it wasn't a big deal. It is very poor from a security perspective now.

mercutio

1392 posts

Uber Geek
+1 received by user: 134

#789168 29-Mar-2013 11:07

they may be filtering dns at the border for residential users (stopping users running their own dns server in the process)

i'd recommend to try doing a resolution from international on effected IP ..

if it works, then this is a VERY SEVERE issue.

sbiddle

30853 posts

Uber Geek
+1 received by user: 9998

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#789188 29-Mar-2013 11:45

mercutio: they may be filtering dns at the border for residential users (stopping users running their own dns server in the process)

i'd recommend to try doing a resolution from international on effected IP ..

if it works, then this is a VERY SEVERE issue.

Resolution works from a number of websites offering nslookup type services.

mercutio

1392 posts

Uber Geek
+1 received by user: 134

#789189 29-Mar-2013 11:49

sbiddle:
mercutio: they may be filtering dns at the border for residential users (stopping users running their own dns server in the process)

i'd recommend to try doing a resolution from international on effected IP ..

if it works, then this is a VERY SEVERE issue.

Resolution works from a number of websites offering nslookup type services.

someone from inside orcon with authority really needs to do a scan on their whole ip address range checking for open resolvers.

was firewall enabled on the genius?

sbiddle

30853 posts

Uber Geek
+1 received by user: 9998

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#789197 29-Mar-2013 11:54

mercutio:
sbiddle:
mercutio: they may be filtering dns at the border for residential users (stopping users running their own dns server in the process)

i'd recommend to try doing a resolution from international on effected IP ..

if it works, then this is a VERY SEVERE issue.

Resolution works from a number of websites offering nslookup type services.

someone from inside orcon with authority really needs to do a scan on their whole ip address range checking for open resolvers.

was firewall enabled on the genius?

Unsure, but I assume so. I was just checking something for somebody who had noticed a lot of extra usage on their connection.

New World

Shop on-line at New World now for your groceries (affiliate link).

mercutio

1392 posts

Uber Geek
+1 received by user: 134

#789204 29-Mar-2013 12:05

sbiddle:
mercutio:
sbiddle:
mercutio: they may be filtering dns at the border for residential users (stopping users running their own dns server in the process)

i'd recommend to try doing a resolution from international on effected IP ..

if it works, then this is a VERY SEVERE issue.

Resolution works from a number of websites offering nslookup type services.

someone from inside orcon with authority really needs to do a scan on their whole ip address range checking for open resolvers.

was firewall enabled on the genius?

Unsure, but I assume so. I was just checking something for somebody who had noticed a lot of extra usage on their connection.

i checked someone on genius's connection after reading this because they had high usage a few days ago, and found their dns was open too. and that their firewall was disabled, and enabling it fixed it.

i couldn't see any option to disable wan dns resolution.

WrEK

86 posts

Master Geek
+1 received by user: 5

#789210 29-Mar-2013 12:29

Mercutio is right, I have tested.
DNS resolution on the WAN interface only works with the firewall off.

They may want to enable the firewall in the Genius modem
Advanced Settings > Firewall > enable

DrFixIt

23 posts

Geek
+1 received by user: 8

Trusted

HD Net

#789239 29-Mar-2013 13:38

By default - the Genius is configured to block pretty much all service ports on the WAN side, with NAT-PMP or UPnP pinholes being created for connections as requested by a PC on the LAN.

It requires user intervention to manually disable the Firewall and is not something that we would ever recommend.

sbiddle

30853 posts

Uber Geek
+1 received by user: 9998

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#789270 29-Mar-2013 14:24

I can confirm that this issue has been resolved by reanabling the firewall.