# Network Mode: Access Point: still DNS proxy? **URL:** \ **Category:** Router\ **Created:** [April 28, 2021, 8:27am UTC](https://forum.gl-inet.com/t/network-mode-access-point-still-dns-proxy/15542 "2021-04-28T08:27:27Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![ICAKaBLO](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/i/439d5e/32.png) [@ICAKaBLO](https://forum.gl-inet.com/u/ICAKaBLO)\ **Post date:** [April 28, 2021, 8:27am UTC](https://forum.gl-inet.com/t/network-mode-access-point-still-dns-proxy/15542/1 "2021-04-28T08:27:27Z")
After changing my GL.iNet White (GL-AR150 with firmware 3.201-release) into the mode ‘Cable LAN’ via the Web interface → More → Network Mode: Access Point, I still see `dnsmasq` be offered on all interfaces, even public ones. I checked this with `netstat -tulpen` on the SSH interface. @GL.iNet, is it possible to disable that in the network mode Access Point? Or, if `dnsmasq` is required internally, restrict it to the localhost interfaces? Currently, an attacker on the network could use that DNS proxy to cloak himself, because services exist which allow surfing via DNS. ---
**Author:** ![alzhao](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/a/5f9b8f/32.png) [@alzhao](https://forum.gl-inet.com/u/alzhao)\ **Post date:** [April 28, 2021, 10:27am UTC](https://forum.gl-inet.com/t/network-mode-access-point-still-dns-proxy/15542/2 "2021-04-28T10:27:27Z")
OK. Understood. Let me check with developers. ---
**Author:** ![ICAKaBLO](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/i/439d5e/32.png) [@ICAKaBLO](https://forum.gl-inet.com/u/ICAKaBLO)\ **Post date:** [April 28, 2021, 11:36am UTC](https://forum.gl-inet.com/t/network-mode-access-point-still-dns-proxy/15542/4 "2021-04-28T11:36:21Z")
Jepp, just change from ANYHOST ( 0.0.0.0 and :: ) to LOCALHOST ( 127.0.0.1 and ::1 ) in mode Access Point. And when I change back to mode Router, change to ANYHOST again. ---
**Author:** ![ICAKaBLO](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/i/439d5e/32.png) [@ICAKaBLO](https://forum.gl-inet.com/u/ICAKaBLO)\ **Post date:** [May 3, 2021, 1:08pm UTC](https://forum.gl-inet.com/t/network-mode-access-point-still-dns-proxy/15542/5 "2021-05-03T13:08:18Z")
Adding ``` listen-address=::1,127.0.0.1 ``` to the file `/etc/dnsmasq.conf` did the trick. With that, the DNS proxy listens not globally anymore but just locally. Until now, I found no way to do this via UCI. > [@alzhao](#): > > Let me check with developers. Any response? Without that trick above, I am having a so called [Open DNS Resolver](https://serverfault.com/a/573471). Could get a real pain not only for others but also for myself, because in a travel scenario I might be in an untrusted network. If each client is isolated, an attacker could browse† via my Open DNS Resolver hiding himself behind my GL.iNet access point. † There exist HTTP over SSH over DNS services, called [DNS Tunneling](https://www.trash.net/dienste/ssh-ueber-dns-tunnel/). ---
**Author:** ![ICAKaBLO](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/i/439d5e/32.png) [@ICAKaBLO](https://forum.gl-inet.com/u/ICAKaBLO)\ **Post date:** [May 25, 2021, 5:20pm UTC](https://forum.gl-inet.com/t/network-mode-access-point-still-dns-proxy/15542/6 "2021-05-25T17:20:05Z")
Did you get any answer from the developers? An Open DNS Resolver is [considered](https://nvd.nist.gov/vuln/detail/CVE-2015-7794) a security issue. That report is about an IP camera. That report got a medium severity because of possible DNS Amplification Attack. Adding the mentioned DNS Tunneling attack, I even [calculated](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator) a high severity. I do not want to create/publish a full blown CVE for that … ---
**Author:** ![alzhao](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/a/5f9b8f/32.png) [@alzhao](https://forum.gl-inet.com/u/alzhao)\ **Post date:** [May 26, 2021, 8:38am UTC](https://forum.gl-inet.com/t/network-mode-access-point-still-dns-proxy/15542/7 "2021-05-26T08:38:15Z")
This is filed as an internal bug. This will be fixed in 3.203. ---
**Author:** ![ICAKaBLO](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/i/439d5e/32.png) [@ICAKaBLO](https://forum.gl-inet.com/u/ICAKaBLO)\ **Post date:** [May 26, 2021, 9:39am UTC](https://forum.gl-inet.com/t/network-mode-access-point-still-dns-proxy/15542/8 "2021-05-26T09:39:14Z")
Yes, when you solve(d) it, please, update this thread how to did it. I think for the world of GL.iNet, the easiest way would be ```auto /etc/init.d/dnsmasq disable /etc/init.d/dnsmasq stop ``` in the Networking Mode ‘Access Point’. And ```auto /etc/init.d/dnsmasq enable /etc/init.d/dnsmasq stop ``` when I switch back to the Networking Mode ‘Router’. ---
**Author:** ![bruce](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/bruce/32/35649_2.png) [@bruce](https://forum.gl-inet.com/u/bruce)\ **Post date:** [October 29, 2025, 4:13am UTC](https://forum.gl-inet.com/t/network-mode-access-point-still-dns-proxy/15542/10 "2025-10-29T04:13:56Z")