Orbi WiFi 7 RBE973
Reply

DNS Rebinding & Permitting a private domain

Smurf_paul
Aspirant

DNS Rebinding & Permitting a private domain

I have some orbi 850's i need to change the DNS rebinding to allow a domain.

Support is zero as its out of warrenty. I cannot find any settings about DNS rebinding protection. Help please.

 

Someone esle asked this a few years ago and got nowhere as again they were out of warrently !

Message 1 of 13
CrimpOn
Guru

Re: DNS Rebinding & Permitting a private domain

 

There are settings to specify which DNS servers the Orbi will use to resolve URLs into IP addresses.

There are no setting specifically addressing how the Orbi handles malicious attempts at "DNS Rebinding"

https://en.wikipedia.org/wiki/DNS_rebinding 

 

Perhaps more detail about the problem will help.  What, specifically, is the goal?

For example, if the goal is to set up a local domain so that devices on the LAN can be referred to by URL rather than IP address, the Orbi DNS software does not provide for this.  I use a Pi-hole server to perform this function to access the web server on my printer.

i.e. rather than http://192.168.1.4, I can browse to http://printer.local

Message 2 of 13
Smurf_paul
Aspirant

Re: DNS Rebinding & Permitting a private domain

Bascically the dns rebinding protection is killing a feature of plex. The solution for almost ever other ap / router is to allow one domain in rebinding settings. Which you have now confirmed that NG dont have.  So £1000 of mesh hardware is rendered obsolute due to a setting not being implimented.

 

Guess lesson learnt, dont buy NG again.

 

Message 3 of 13
CrimpOn
Guru

Re: DNS Rebinding & Permitting a private domain

Oh, geez.  I have not run across that Plex feature problem yet. Can you point me to a reference on the issue?

Message 4 of 13
RedRocket204
Aspirant

Re: DNS Rebinding & Permitting a private domain

@CrimpOn 

 

I do realize your post is from two months ago, hoping you still might have an interest in this issue from the OP. What the OP is referring to is utilizing a Plex server on your private network to download/transfer content from the Plex server to a mobile device, like an iPad that is also on the same private network.

 

Getting really frustrating with the "download" function not working very well... 

 

I have also been experiencing this same issue and am looking to resolve it. What I find pretty interesting is I have an identical setup, or very close, to the same setup OP is running:

 

Orbi Mesh with version V2.7.4.24

CenturyLink Zyxel C3000Z (VDSL "Slow" Internet running firmware CZD005-4.16.011.0)

 

Per that reddit thread I've linked, explains in detail what those have presumably done to fix the issue. I have change my Orbi DNS to the google addresses for now but I'm still getting the content transfer failures as though nothing was resolved. Seems it is possible the DNS Rebind Protection might be key here but admittedly, I'm not entirely familiar with DNS Rebind Protection and if it effectively isn't in play if I manually set my DNS specifically to something like google.

Message 5 of 13
CrimpOn
Guru

Re: DNS Rebinding & Permitting a private domain


@RedRocket204 wrote:

@CrimpOn 

I do realize your post is from two months ago, hoping you still might have an interest in this issue from the OP. What the OP is referring to is utilizing a Plex server on your private network to download/transfer content from the Plex server to a mobile device, like an iPad that is also on the same private network.


I was drawn to the specific question of what control the user has over DNS Rebind  Protection on Orbi routers, which is zero.  There is no user setting.

 

However, I sense a different factor may be involved.  Is the Plex server perhaps connected to an Ethernet switch that is connected to the Orbi router?

 

At first, the primary question seems absurd.  A Plex server and a user device are on the same private network.  That seems to be "what Plex is designed for."  How could the user device be unable to stream/download content?  I could see issues where the user device is remote (on the internet somewhere), but on the same network? No way.

 

Just by accident, I discovered that some Ethernet switches implement IGMP Snooping, but do not do it very well. When that happens, user devices lose access to media servers that are connected behind a switch.

 

I would tend to look toward Plex resources to resolve LAN connection issues, such as:

https://support.plex.tv/articles/200430283-network/ 

 

Message 6 of 13
RedRocket204
Aspirant

Re: DNS Rebinding & Permitting a private domain

@CrimpOnYes, I have an unmanaged switch that is connected between my Orbi and headless MAC mini that is hosting the Plex server. Obviously the iPad is connecting to the Orbi over Wifi and have really not made many changes on the Orbi other than removing/changing security for access control. The only setting I've made which has not left settings as default was manually adding in my own DNS servers, google. As you would know, since the switch is unmanaged, it is basically a "dumb" hub meant to expand the available ethernet connections at the edge.

 

This whole scenario of persistent content download failures to the iPad from the Plex server on a flat network is most likely predicated from poor internal process of Plex transcoding and handling of the content. The calls are probably not tested well, the server versions seem to update frequently as well as the mobile apps.

 

Thanks for your thoughts on this.

Message 7 of 13
CrimpOn
Guru

Re: DNS Rebinding & Permitting a private domain

Can you share the specific model of switch? 

Message 8 of 13
RedRocket204
Aspirant

Re: DNS Rebinding & Permitting a private domain

DLink DGS-108 - it's an 8-port unmanaged consumer gigabit switch.

 

I probably didn't explain the situation correctly though. The iPad can connect to Plex and stream content, no issues there. I can also have the iPad successfully kick-off the content download, no issues there. It is when the content is being transferred, a transcoding process is running on the Plex. The content on Plex is typically 1080P at a pretty high bitrate and the original format of the content results in pretty large file sizes. Besides the part of higher res and bitrate are pretty big overkill when viewing direct on the iPad, I don't have a lot of space, so transcoding the content into something like 720P at 2-3mbps is plenty quality wise and allows for more content on my 32GB iPad.

 

Some may find this dumb, but reasoning behind downloading the content is I go boondocking in central CO for 1 1/2 weeks where there is no mobile signal. I actually transfer fly tying videos, and some movies, and bring all of my fly tying stuff in my travel trailer. The movies are for night or if it decides to rain. Yes, I can get by without downloaded movies during my trip but like to have some of my other videos for difficult patterns I don't tie often.

Message 9 of 13
CrimpOn
Guru

Re: DNS Rebinding & Permitting a private domain

Thanks for the information.  Makes perfect sense to me. Totally reasonable thing to do.

 

The DGS-108 actually does have IGMP snooping:

https://us.dlink.com/en/products/dgs-108-8-port-unmanaged-gigabit-metal-desktop-switch 

 

I searched Amazon looking for a switch that does not include IGMP snooping.  The Netgear GS-308 is inexpensive.  The Netgear data sheet does not mention IGMP snooping, but the Amazon description does.  (Who to believe: the manufacturer or Amazon?)

 

Would Plex have an option to transcode the video file to lower resolution/bandwidth, store that version under a different name, and then download the smaller file?  Or, is it downloading anything that fails?

Message 10 of 13
RedRocket204
Aspirant

Re: DNS Rebinding & Permitting a private domain

That is beyond strange about the DLink switch.I would never have guessed it had IGMP Snooping on it but I suppose who am I to say if someone would be using multicast. I actually work with multicast video products although I've never had to setup a network for multicast video but do know well the differences between ASM and SSM where SSM does require snooping turned on.

 

Plex is not designed as an offline transcoder, it has on-the-fly transcoding based on requests for the content. You can set max resolution and approximate bitrates on the transcoded content but there are not many knobs other than that. You actually bring up an interesting point about it though, I've never looked into how the Plex and app work together but assuming simple https GET requests for the content, just never curious about it until now especially considering the work I do.

 

Very much appreciate your insight and willingness to help spark ideas. Thank you!

Message 11 of 13
RedRocket204
Aspirant

Re: DNS Rebinding & Permitting a private domain

Transcoding on the Plex is kicked off by way of the request as mentioned and it does that if watching it live or if downloading the content to mobile device. So no, it does not have the ability to separate downloading from the transcoding process or vice-versa. Unless you specifically set it up for downloading original content. But again, that gets back to the files being way too large and extremely limits the amount of content I can download to my iPad.

Message 12 of 13
CrimpOn
Guru

Re: DNS Rebinding & Permitting a private domain

Apart from investing $25 in a different Ethernet switch on the off-chance that IGMP snooping somehow affects downloading but not streaming, I'd look in two directions:

  • Some obscure Plex setting that affects download but not streaming. (my first thought is that it must be the Plex Client that controls this if the server is going to transcode for both operations)
  • Manually transcode the videos using a different product and then either copy them to the iPad manually or load them back into Plex with a different name.
    Handbrake claims to convert almost anything into anything else: https://handbrake.fr 
    VLC claims to convert files.

 

Message 13 of 13
Top Contributors
Discussion stats
  • 12 replies
  • 2271 views
  • 2 kudos
  • 3 in conversation
Announcements

Orbi WiFi 7