rebind

rebind

Name

rebind - guards against DNS rebind attacks by removing answers that point to local/private IP ranges from responses.

Description

The rebind plugin helps prevent DNS rebind attacks by filtering out any local/private range IP addressed from answers before writing the response to the client.

Syntax

rebind [ZONES...] {
    except [ZONES...]
    filter [CIDRS...]
}

• rebind ZONES... defines the ZONES that will be filtered. If ZONES is empty or not specified, the list of zones is inherited from the enclosing server block.

• except ZONES... excludes zones listed in ZONES from rebind filtering. This should be used to prevent filtering of responses containing legitimate private IP coming from known private zones.

• filter CIDRS... defines the list of subnet CIDRs that will be considered private/local and should be removed from answers. By default the following ranges are filtered

  • IPv6 private: fc00::/7 fec0::/10
  • IPv4 private: 10.0.0.0/8 192.168.0.0/16 172.16.0.0/12
  • IPv6 link local: fe80::/10
  • IPv4 link local: 169.254.0.0/16
  • IPv6 loopback: ::1/128
  • IPv4 loopback: 127.0.0.0/8

  Note that when this option is used the entire default list of CIDRs above is replaced with the list of CIDRs specified in this option.

External Plugin

rebind is an external plugin, which means it is not included in CoreDNS releases. To use rebind, you'll need to build a CoreDNS image with rebind included. In a nutshell you'll need to:

• Clone https://github.com/coredns/coredns
• Add this plugin to plugin.cfg per instructions therein. It should be positioned after cache, but before other plugins that provide answers.
• Then build and release to your personal github/dockerhub repos using Makefile.release and Makefile.docker.

Examples

. {
    rebind
    forward . 8.8.8.8
}

. {
    rebind . {
       except myzone
    }
    file db.myzone myzone
    forward . 8.8.8.8
}

Metrics

If used in conjunction with the prometheus plugin then the following metrics are exported:

• coredns_rebind_answers_removed_total{server} - counter of answers renoved from responses

The server label is defined in the prometheus plugin documentation.