Hi there,
I received an email from [REMOVEDVirginMedia.com yesterday stating that a device connected to my home network had been identified as having a potential Open DNS Resolver (ODNSR) Vulnerability.
I have a ASUS BE98 Router all settings have been left on default, any help to resolve this would be greatly appreciated, as I am not very tech savvy.
Mod Edit : Private information has been removed. Please see our forum guidelines for more information
Firstly, If you have am GT-BE98U, then you may want to keep an eye on developer GNUTON's firmware - he is mirroring what MERLIN firmware does. Merlin is doing firmware for non UK GT-BE98 Pro, and GNUTON is doing firmware for UK/Europe GT-BE98U. Both developers work closely with Asus, and often Asus takes their work and puts into the Asus stock firmware. Do a search for Merlin to read about features then the actual firmware for GT-BE98 from GNUTON. Here you can set your DNS servers to be DNS over TLS for encrypted DNS lookups, bypassing your ISP's DNS servers and you can turn on DNSSec to avoid man in the middle attacks by ensuring only authoritative DNS servers are used and not ones pretending to be. With GNUTON's firmware you can also install a raft of security add-ons via AMTM command in SSH, including Diversion AD blocker, LED light control for scheduled on/off, and Skynet for detailed IP Rules.
Back to your issue, if you left the Asus stock firmware as default as you stated, none of this will be set to OpenDNS for your router's DNS lookups. You may have a device that has had its DNS changed manually to Open DNS DNS servers like 208.67.222.222 or 208.67.220.220 in the network interface settings under DNS, or you have the OpenDNS agent running on a machine which on Microsoft Windows would be listed in 'Programs and Features' or Settings > Apps > Installed Apps.
Use this to help see if you have OpenDNS resolver vulnerability:
https://openresolver.com
Lastly, run this on Windows in a command prompt, preferably from a different network:
nslookup bbc.co.uk [Your WAN IP Address]
If you get any response, your router is processing DNS requests on port 53. You can get your WAN IP from Asus router info, or by going to www.whatsmyip.org
thank you for your reply.
hi there I followed your advice and got the following results
openresolver
gave me
IP Address (the IP address virgin say is open) is not vulnerable to DNS Amplification attacks.
command prompt
gave me
nslookup bbc.co.uk (my Wan IP Address)
Non-authoritative answer:
Name: bbc.co.uk
Addresses : 2a04:4e42:200::81
2a04:4e42:400::81
2a04:4e42:600::81
2a04:4e42::81
151.101.0.81
151.101.64.81
151.101.128.81
151.101.192.81
no idea what the numbers mean?
Those IP are the BBC addresses via Fastly (its like Cloudflare and provides DDOS protection amongst other things).
Something must be doing DNS on your network from your router is you did this to your public IP address that your router is using...
the IP Address virgin say is vulnerable is the Wan IP from the Asus BE98 not any device as far as I can see
When you performed this test : nslookup bbc.co.uk (my Wan IP Address)
what was the DNS that resolved the query ? It is usually shown as Server: <host name>
it showed
Server: cpc159435-dudl15-2-0-cust30.16-1.cable.virginm.net
cpc159435-dudl15-2-0-cust30.16-1.cable.virginm.net responds to my nslookup queries too.
Is there a port forward entry for port 53 that needs to be deleted ?
Use the Router's web admin menu check.
Port Trigger is off
Port Forwarding is off
Failing this do you have any devices on your home network that contain unusual or irregular software ? Typically these might be devices used to access streaming TV services that are not operating on a genuine subscription via the original content provider.
Could also be a Router or NAS that are operating on a third party firmware.
I do have 1 firestick but is used for netflix you tube etc.
switch everything off and test each time before powering next on. Prob easiest way if no rules set on the router. I have a GT-BE98U as well as nothing going on with either stock Asus or GNUTON firmware (basically a copy of Merlin's from BE98 Pro model). Previous AX86U models didn't have any issue either. I'm assuming you have used Asus stock firmware and its on latest build, so cant install any add-ons via SSH via AMTM like you can with Merlin/Gnuton.
hi yes its on stock firmware on latest. I will try what you said
I had a ASUS AXE11000 before I swapped it out to a BE98 had no issues with that one
Similar issue from 2 years ago:
https://community.virginmedia.com/discussions/Internet_Security/open-dns-resolver/5436964/replies/5454420
Apparrently, enabling certain "features" on Asus routers can turn your whole internet into a public DNS resolver.
Only way to fix the issue is a factory reset according to that thread.
hmmm interesting thanks.
Hmmm. That was faulty firmware by sounds of it and was 2 years ago. I have VPN on my BE98 and it is not doing public DNS lookups.
One service not to use (as it recently had major security flaw, but is now fixed, for now) is AIDISK and personally, I wouldn't use any ASUS services like their DDNS, SmartAccess, iTunes Media Server, UPnP Media Server, FTP Share. Check to see if these Asus specific services are OFF.
The best firmware is going to be GNUTON's (Merlin) though, as they fix bugs, have extra features than the stock Asus firmware.
everything is off on my BE98 don't use any services.
even turned off web access from WAN. Everything is showing green on Ai protection.
yes I had merlin firmware on my GT-AXE11000 worked well no issues, i use it as a mesh node now.
Performing a DNS Leak test with the OP's Public IP as the DNS Server reveals the DNS queries are being resolved via a Virgin Media DNS server.
If the ASUS BE98 Router has been configured to use the VM DNS servers this
would not be a surprise. But would keep the focus on the ASUS BE98 Router
as the #1 suspect.
You can use other DNS servers via drop down menus in stock firmware (and GNUTON's). You can even use DNS over TLS and DNSSEC via drop down menus to move away from VM DNS if OP wanted to.
The Asus services need to be disabled as I posted earlier to rule them out. As the OP is on original stock firmware, they won't have additional add-ons enabled by AMTM via SSH access.
The OP should also check they are on latest Asus firmware version due to MANY bugs being squashed in previous - to the point, you can no longer (easily) roll back firmware to an earlier version and those removed from Asus downloads. At time of writing this is 3.0.0.6.102_36878 and can be updated by GUI or downloading the file from Asus and using the GUI to do a manual upload to router.
