# \[Technical\] The pros and cons of DNS Rebinding protection

**URL:** <https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889>\
**Category:** Off-Topic\
**Tags:** homey-pro\
**Created:** [February 6, 2022, 4:12pm UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889 "2022-02-06T16:12:17Z")\
**Posts on this page:** 7\
**Page:** 2

<div class="post-metadata">

**Author:** ![prosumer](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/prosumer/32/166478_2.png) [@prosumer](https://community.homey.app/u/prosumer)\
**Post date:** [February 6, 2022, 9:12pm UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/21 "2022-02-06T21:12:17Z")

</div>

Using [Proxyman](https://proxyman.io/) on my iPhone/iPad I discovered that the Homey App was indeed trying HTTPS to access `192.168.1.x.homey.homeylocal.com` first, but all requests failed and it then tried HTTP instead (which succeeds).

Since this is only related to local traffic, I tried to solve it via my router, instead of NextDNS. I have an ASUS router which runs the excellent [AsusWrt-Merlin](https://www.asuswrt-merlin.net/) third-party firmware. I added this line to the [dnsmasq configuration file](https://github.com/RMerl/asuswrt-merlin.ng/wiki/Custom-domains-with-dnsmasq) `/jffs/configs/dnsmasq.conf.add` (to bypass NextDNS - and thus its DNS Rebinding Protection?):

```auto
address=/192-168-1-x.homey.homeylocal.com/192.168.1.x

```

After restarting both the dnsmasq service on the router and the Homey App on my iOS devices the requests now succeed using HTTPS and there is no fallback to HTTP!

Thank you for bringing this to our attention @Dijker!

---

<div class="post-metadata">

**Author:** ![prosumer](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/prosumer/32/166478_2.png) [@prosumer](https://community.homey.app/u/prosumer)\
**Post date:** [February 6, 2022, 9:34pm UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/22 "2022-02-06T21:34:54Z")

</div>

Oh, it’s even nicer to learn about this in my case!

In the past I changed the "_Homey p1 smartmeter DSMR reader for [com.p1.smartmeter](https://github.com/koktaildotcom/com.p1.smartmeter)_" script to use the (local) IP address `192.168.1.x` (I have assigned a fixed IP to Homey in my router) instead of the (external) hostname `<homeyId>.connect.athom.com`, but as a side effect I had to use HTTP because the Homey did not have a SSL certificate for that IP address.

With this new knowledge and the dnsmasq workaround I can now use the hostname `192-168-1-x.homey.homeylocal.com` instead of the IP address `192.168.1.x` _with HTTPS_.

---

<div class="post-metadata">

**Author:** ![Dijker](https://avatars.discourse-cdn.com/v4/letter/d/b9bd4f/32.png) [@Dijker](https://community.homey.app/u/Dijker)\
**Post date:** [February 6, 2022, 9:35pm UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/23 "2022-02-06T21:35:08Z")

</div>

> [@robertklep](#):
>
> Also, I assume that every Homey uses the exact same certificate.

I already verified that on 3 Local Homey Pro’s here. Therefore it is a Wildcard 😉

---

<div class="post-metadata">

**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\
**Post date:** [February 7, 2022, 6:24am UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/24 "2022-02-07T06:24:05Z")

</div>

I also run dnsmasq locally, with DNS rebinding protection enabled except for the `homeylocal.com` domain:

```auto
stop-dns-rebind
rebind-domain-ok=homeylocal.com

```

---

<div class="post-metadata">

**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\
**Post date:** [February 7, 2022, 6:25am UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/25 "2022-02-07T06:25:57Z")

</div>

> [@Dijker](#):
>
> Therefore it is a Wildcard

That’s indeed what the certificate shows:

```auto
$ echo | \
    openssl s_client -servername 192-168-1-10.homey.homeylocal.com -connect 192.168.1.10:443 2>/dev/null | \
    openssl x509 -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            03:c9:46:27:6a:63:fc:a6:fd:f4:c6:e4:90:f5:4a:00:4c:2d
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=Let's Encrypt, CN=R3
        Validity
            Not Before: Dec 6 03:01:23 2021 GMT
            Not After : Mar 6 03:01:22 2022 GMT
        Subject: CN=*.homey.homeylocal.com
…

```

---

<div class="post-metadata">

**Author:** ![prosumer](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/prosumer/32/166478_2.png) [@prosumer](https://community.homey.app/u/prosumer)\
**Post date:** [February 7, 2022, 9:14am UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/26 "2022-02-07T09:14:04Z")

</div>

> [@robertklep](#):
>
> ```auto
> stop-dns-rebind
> rebind-domain-ok=homeylocal.com
> 
> ```

Nice! Unfortunately, I can’t use that, as the [NextDNS install script](https://github.com/nextdns/nextdns/blob/master/router/merlin/setup.go) removes the `stop-dns-rebind` line from the router’s configuration (NextDNS takes care of DNS Rebinding Protection in my setup).

> [@Dijker](#):
>
> Therefore it is a Wildcard

Indeed; I can use

```auto
address=/my.homey.homeylocal.com/192.168.1.x

```

instead of

```auto
address=/192-168-1-x.homey.homeylocal.com/192.168.1.x

```

for (and in) the P1 script and that still works with HTTPS, it seems.

---

<div class="post-metadata">

**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\
**Post date:** [February 7, 2022, 3:30pm UTC](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889/27 "2022-02-07T15:30:20Z")

</div>

> [@prosumer](#):
>
> Unfortunately, I can’t use that, as the [NextDNS install script](https://github.com/nextdns/nextdns/blob/master/router/merlin/setup.go) removes the `stop-dns-rebind` line from the router’s configuration (NextDNS takes care of DNS Rebinding Protection in my setup).

So change the script 😛 According to NextDNS, the allow list _“takes precedence over everything else, including security features”_, so perhaps it’s possible to add an exception for `homeylocal.com`?

[Previous page](https://community.homey.app/t/technical-the-pros-and-cons-of-dns-rebinding-protection/59889.md?page=1)