After upgrading my Beryl to firmware v. 3.201 for couple days now, today I found out that my phone and PC suddenly didn’t resolve to domain names but can PING to IP address directly (DNS issues).
Logging in router with SSH, check if Stubby(with NextDNS configured) is running ok, it seems that nothing goes wrong with DNS related setup. After fiddling around, uncheck “DNS Rebinding Attack Protection” option through GUI, DNS resolving on client side immediately returned to normal.
What I learned: Stubby still have issue with “DNS rebinding attack protection” option turned ON and it must be OFF to make sure it will resolve DNS normally in the long run.
FWIW – I think this is perhaps intrinsic to how NextDNS selective blocking works. It returns 0.0.0.0 for blocked domains which dnsmasq considers, correctly in some sense, to be a private IP to protect from rebinding when that’s enabled (I think it’s the dnsmasq layer doing so, not stubby). Here are some links I found helpful in piecing this together:
But note that NextDNS has its own rebind protection setting which should do the job in this scenario.
Edited to add: appears that a recent change to dnsmasq treats 0.0.0.0 as localhost, like 127.0.0.1, so that the --rebind-localhost-ok option would allow this response.