# \[Technical\] The pros and cons of DNS Rebinding protection **URL:** \ **Category:** Off-Topic\ **Tags:** homey-pro\ **Created:** [February 6, 2022, 4:12pm UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889 "2022-02-06T16:12:17Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Dijker](https://avatars.discourse-cdn.com/v4/letter/d/b9bd4f/32.png) [@Dijker](https://community.homey.app/u/Dijker)\ **Post date:** [February 6, 2022, 4:12pm UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/1 "2022-02-06T16:12:18Z")
> Warning, This topic discusses an deep technical network issue. It should not be an issue for most of the average Homey Pro users on default consumer Internet connections. ## The pros and cons of DNS Rebinding protection Athom uses a technique for secure communication on your Local Network (WiFi) that possibly conflicts with another security option available in newer consumer routers and access points. I created this Topic to provide a central place to discuss the issue and possible solutions. Please let me know if you want to Edit this Topic. ## The issue with DNS Rebinding. Technically for remote attackers it could be possible to use several ways of DNS Rebinding to Access a device on your Local network by sending Local IP addresses on your DNS Requests. As this Could be unwanted it is possible to protect you with several options: - Rebind Protection in WebBrowsers - Rebind Protection in DNS Resolvers / Routers. - … Rebind Protection in DNS Resolvers / Routers filter out (all or some of) the local IP addresses in responses from DNS requests to internet and several newer routers have that option and enable it by default. Sometimes the options are added to provider Routers/modems in newer firmware and enabled. ## The Issue with Homey using DNS Rebind protection When you’re at home, Homey first tries to use a local secure connection (HTTPS). Only when local TLS does not work, Homey uses a local insecure connection (HTTP). Homey uses a SSL Certificate (Needs to for encryption) and for that Certificate it needs to be accessed using a FQDN on that certificate. This is the DNS name that Homey uses with your Local IP Address: [1-2-3-4.homey.homeylocal.com](http://1-2-3-4.homey.homeylocal.com). Where the first numbers should reflect your Homey Pro’s local IP address separated by dashes. It alway resolves to that same IP address. Usually if the connection in your Homey Mobile App doesn’t work “Local (Secure)” it switches to “Local” and drops the extra encryption. This should be no issue as you should be on your own “protected” WiFi / LAN network at that moment. Sometimes Users in the community complain Homey Pro isn’t stable working / often disconnects / etc. In that case you could test temporary if disabling DNS Rebind protection in your router solves this issue. In the case that solves it please report your issue / temporary workaround to Athom Support. (As disabling DNS Rebind protection is your own Risk and choice). Also please report here in this Topic your Network configuration (ISP, Router brand and Firmware version, setting you changed) it could help other community members. ## More information - The Athom Support page mentioning it: [https://support.homey.app/hc/en-us/articles/360015685913-Securing-Homey-Pro](https://support.homey.app/hc/en-us/articles/360015685913-Securing-Homey-Pro) - The Wikipedia page with more technical details and explanation: [DNS rebinding - Wikipedia](https://en.wikipedia.org/wiki/DNS_rebinding) - Topic about DNS Rebind protection on Community for Pi-Hole [Why won't Pi-hole work with DNS rebind protection enabled? - FAQs - Pi-hole Userspace](https://discourse.pi-hole.net/t/why-wont-pi-hole-work-with-dns-rebind-protection-enabled/3142) > I will create two Reserved Posts for updating with fe known issues or configurations and move a recent discussion below. PM me if I missed something, if you have additional information or want to add something to this post. If necessary we can make it a Wiki ---
**Author:** ![Dijker](https://avatars.discourse-cdn.com/v4/letter/d/b9bd4f/32.png) [@Dijker](https://community.homey.app/u/Dijker)\ **Post date:** [February 6, 2022, 4:12pm UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/2 "2022-02-06T16:12:24Z")
Reserved ---
**Author:** ![Dijker](https://avatars.discourse-cdn.com/v4/letter/d/b9bd4f/32.png) [@Dijker](https://community.homey.app/u/Dijker)\ **Post date:** [February 6, 2022, 4:12pm UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/3 "2022-02-06T16:12:30Z")
Reserved ---
**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\ **Post date:** [February 4, 2022, 1:54pm UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/4 "2022-02-04T13:54:31Z")
> [@Internet outage](https://community.homey.app/t/internet-outage/59652/9): > > BUT as the IP address is local, then some security-aware nameservers/local networks does not allow the name to IP resulution for … Yes, to make Homey “more secure” you have to downgrade the security of your entire local network. It’s a feature, not a bug. ---
**Author:** ![Cuprum](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/cuprum/32/41409_2.png) [@Cuprum](https://community.homey.app/u/Cuprum)\ **Post date:** [February 4, 2022, 2:38pm UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/5 "2022-02-04T14:38:09Z")
> [@robertklep](#): > > It’s a feature, not a bug Yes, this is better, than some competitors, does not havin’ https at all. May-be the same reason, do not have browsers/developers complain. No certificate - no problem 🤐 ---
**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\ **Post date:** [February 4, 2022, 4:10pm UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/6 "2022-02-04T16:10:28Z")
> [@Cuprum](#): > > This is better, than some competitors, does not havin’ https at all Using HTTPS on a local network doesn’t add a whole lot of security, certainly not so much that it warrants having to disable DNS rebinding attack protection to get it working. It also requires an always-on internet connection, because the hostname should be resolvable. ---
**Author:** ![Cuprum](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/cuprum/32/41409_2.png) [@Cuprum](https://community.homey.app/u/Cuprum)\ **Post date:** [February 6, 2022, 6:04am UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/7 "2022-02-06T06:04:10Z")
From my point of view it’s really depends. But for me personally seems, that unencrypted traffic in “public network” is little bit bigger sin than … Yeah, sorry, but most of nowadays home-users WiFi networks are actually just waiting someone to join ;( So, may-be then for Athom - give to Homey also certificate with alias from local DNS, not a “one for all” - ‘\*.homey.homeylocal.com’ ---
**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\ **Post date:** [February 6, 2022, 7:14am UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/8 "2022-02-06T07:14:56Z")
> [@Cuprum](#): > > Yeah, sorry, but most of nowadays home-users WiFi networks are actually just waiting someone to join ;( > > So, may-be then for Athom - give to Homey also certificate with alias from local DNS, not a “one for all” - ‘\*.homey.homeylocal.com’ I don’t see how that’s possible, you can’t get certificates for hostnames like `homey.local`. Regarding bad WiFi networks: at least that requires a relatively close proximity to the network to be abused. And _when_ it gets abused, it’s not likely that the communication between Homey and your mobile phone is the likely target. Whereas DNS rebinding attacks can be done remotely and can be just as damaging as a WiFi hack. ---
**Author:** ![Dijker](https://avatars.discourse-cdn.com/v4/letter/d/b9bd4f/32.png) [@Dijker](https://community.homey.app/u/Dijker)\ **Post date:** [February 6, 2022, 8:22am UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/9 "2022-02-06T08:22:17Z")
> [@robertklep](#): > > Whereas DNS rebinding attacks can be done remotely and can be just as damaging as a WiFi hack. Guess Athom follows you on that point and if I remember changed their point. Although not that clear for a normal user what to do but I guess Athom isn’t the one responsible for education of users the differences on such a complex topic. > Note: Some routers block a feature called ‘DNS Rebinding’. For a local secure connection to work, this feature must be disabled. We do not advice to do this, but it’s something to consider. [https://support.homey.app/hc/en-us/articles/360015685913-Securing-Homey-Pro](https://support.homey.app/hc/en-us/articles/360015685913-Securing-Homey-Pro) So if I understand correctly everything should function the same with DNS rebinding protection enabled. With only difference for connections are local unencrypted. ---
**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\ **Post date:** [February 6, 2022, 8:31am UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/10 "2022-02-06T08:31:48Z")
> [@Dijker](#): > > So if I understand correctly everything should function the same with DNS rebinding protection enabled. Well yes, in theory. In practice, search around on the forum for people having issues with their Homey being “offline” until they disable it. ---
**Author:** ![Cuprum](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/cuprum/32/41409_2.png) [@Cuprum](https://community.homey.app/u/Cuprum)\ **Post date:** [February 6, 2022, 10:14am UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/11 "2022-02-06T10:14:53Z")
> [@robertklep](#): > > I don’t see how that’s possible, you can’t get certificates for hostnames like `homey.local` . Actually every Homey knows his hostname - at least i hope so. So, during “E.T. calls home”, it’s possible to ask also certificates. Yes, this is additional connection and also may lead to some delay during initial connect (and also, when someone changes the hostname). But in theory this must be working. > [@robertklep](#): > > Regarding bad WiFi networks: at least that requires a relatively close proximity to the network to be abused. Yeah, of course… or nope, if The Bad is really interested… or just a DIY-ers with “[Pringles cantenna](https://www.makeuseof.com/tag/how-to-make-a-wifi-antenna-out-of-a-pringles-can-nb/)”. And even without such equipment. Have seen ~50 different WiFi networks on my phone in “normal situation” (just a dense living block, _not_ some exhibition or something) About targets… Actually, Homey smells like honey for attacker. For proffessional - it’s the key for doorlock, disarm button for alarm system and also indicator about presence. For amateur it’s very interesting to see: Sending packet and there the light switch on. About communication between phone and Homey - start some sniffer, and look, how many “bonjours” and SSDP-s You can count from Homey during a minute. So, target is self-advertising. Only sniff some real connection (as this is WiFi, then it’s public, no need to fool switches) and take the bearer. ---
**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\ **Post date:** [February 6, 2022, 11:46am UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/12 "2022-02-06T11:46:39Z")
> [@Cuprum](#): > > Actually every Homey knows his hostname. On my local network, Homey’s hostname is “Homey”. That’s not something you can get a certificate for. It’s also not how the app connects with Homey (because it depends too much on your local setup to actually work). That’s why the `homeylocal.com` workaround is used. > [@Cuprum](#): > > About targets… Actually, Homey smells like honey for attacker. For proffessional - it’s the key for doorlock, disarm button for alarm system and also indicator about presence. For amateur it’s very interesting to see: Sending packet and there the light switch on. > > About communication between phone and Homey - start some sniffer, and look, how many “bonjours” and SSDP-s You can count from Homey during a minute. So, target is self-advertising. Only sniff some real connection (as this is WiFi, then it’s public, no need to fool switches) and take the bearer. Agreed, Homey is a great target. And if people are stupid enough to use bad WiFi, they’re also stupid enough to use Homey as an alarm system 😉 But if I were a professional, I would look into how each Homey receives the private keys for the `*.homeylocal.com` certificate from Athom’s servers: endless MITM possibilities 😅 ---
**Author:** ![prosumer](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/prosumer/32/166478_2.png) [@prosumer](https://community.homey.app/u/prosumer)\ **Post date:** [February 6, 2022, 4:21pm UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/13 "2022-02-06T16:21:57Z")
What about DNS services that offer [DNS Rebinding Protection](https://help.nextdns.io/t/35hmval/what-is-dns-rebinding-protection), like [NextDNS](https://nextdns.io)? (I seem to have that option enabled in that service) ---
**Author:** ![Dijker](https://avatars.discourse-cdn.com/v4/letter/d/b9bd4f/32.png) [@Dijker](https://community.homey.app/u/Dijker)\ **Post date:** [February 6, 2022, 4:25pm UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/14 "2022-02-06T16:25:48Z")
> [@robertklep](#): > > But if I were a professional, I would look into how each Homey receives the private keys for the `*.homeylocal.com` certificate from Athom’s servers: endless MITM possibilities 😅 Again /OT Interesting if they provide all Homey Pro’s a new Private Key or only extend a Certificate. Keep an Eye on it next month. ![image](https://us1.discourse-cdn.com/flex025/uploads/athom/original/3X/7/a/7a9e201e75e5cc5f8b7efad98b20ab2ba73538e8.png) ![image](https://us1.discourse-cdn.com/flex025/uploads/athom/original/3X/5/5/555498b71e9da6d1c722070f73612b56dcb53e25.png) ---
**Author:** ![prosumer](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/prosumer/32/166478_2.png) [@prosumer](https://community.homey.app/u/prosumer)\ **Post date:** [February 6, 2022, 4:31pm UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/15 "2022-02-06T16:31:31Z")
> [@Dijker](#): > > Homey uses a SSL Certificate (Needs to for encryption) and for that Certificate it needs to be accessed using a FQDN on that certificate. Is this a self-signed certificate or one assigned by a trustworthy Certificate Authority which validated Athom’s identity? ---
**Author:** ![Dijker](https://avatars.discourse-cdn.com/v4/letter/d/b9bd4f/32.png) [@Dijker](https://community.homey.app/u/Dijker)\ **Post date:** [February 6, 2022, 4:32pm UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/16 "2022-02-06T16:32:08Z")
> [@prosumer](#): > > What about DNS services that offer [DNS Rebinding Protection](https://help.nextdns.io/t/35hmval/what-is-dns-rebinding-protection), like [NextDNS](https://nextdns.io)? Maybe you can make an exception for this DNS domain or add your own record for your Homey Pro and give it an DHCP reservation. > Name: [1-2-3-4.homey.homeylocal.com](http://1-2-3-4.homey.homeylocal.com). > Address: 1.2.3.4 ---
**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\ **Post date:** [February 6, 2022, 7:08pm UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/17 "2022-02-06T19:08:46Z")
> [@Dijker](#): > > or only extend a Certificate AFAIK, there’s no such thing as extending a certificate, you’ll just get a new one. With a new private key. A Homey can’t request this by itself (because of validation), so it’s something that Athom needs to do on their servers and then distribute the new certificate (including its private key) among all active Homey’s. ---
**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\ **Post date:** [February 6, 2022, 7:12pm UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/18 "2022-02-06T19:12:29Z")
> [@prosumer](#): > > Is this a self-signed certificate or one assigned by a trustworthy Certificate Authority which validated Athom’s identity? Neither. It uses [Let’s Encrypt](https://letsencrypt.org/), so the certificates are accepted by pretty much all TLS implementations, but Let’s Encrypt doesn’t perform identity validation (only domain validation). ---
**Author:** ![Dijker](https://avatars.discourse-cdn.com/v4/letter/d/b9bd4f/32.png) [@Dijker](https://community.homey.app/u/Dijker)\ **Post date:** [February 6, 2022, 7:33pm UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/19 "2022-02-06T19:33:12Z")
> [@robertklep](#): > > AFAIK, there’s no such thing as extending a certificate, you’ll just get a new one. With a new private key. Yes I know, the “Certificate” itself is new but the Priv Key isn’t necessary. With all othe infor the same I Guess it is often called “Renew” a Certificate. > **[FAQ](https://letsencrypt.org/docs/faq/)** > > This FAQ is divided into the following sections: > General Questions Technical Questions General Questions What services does Let’s Encrypt offer? Let’s Encrypt is a global Certificate Authority (CA). We let people and organizations around the world... > ## Can I use an existing private key or Certificate Signing Request (CSR)? > > Yes, but not all clients support this feature. [Certbot](https://certbot.eff.org/) does. But pretty sure Athom can let Homey Pro’s replace Both the Certificate and the Private Key without Firmware changes. Guess Homey has a standard service that Request and installs it at a Homey Cloud server. ---
**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\ **Post date:** [February 6, 2022, 9:10pm UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/20 "2022-02-06T21:10:30Z")
> [@Dijker](#): > > But pretty sure Athom can let Homey Pro’s replace Both the Certificate and the Private Key without Firmware changes The only way I see how is by downloading both from Athom servers at a regular interval. Because it’s a wildcard certificate, DNS validation is required so renewing the certificate is not something that a Homey can do by itself automatically. Also, I assume that every Homey uses the exact same certificate. [Next page](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889.md?page=2)