possible DNS-rebind attack detected: dc.rm.skyq.info

[gipjon]

last 18 months no issues at all with the router 

I started having issues , 3 times so far in 6 weeks

I think the router software crashes or the router is locking up 

The router stays connected to the internet

All devices are reporting connected to the router but only some will have internet, Other devices say connected to the router but no internet. you can swap from wired to wifi and still have the same issue, it's like the mac address is blocked.  

The other thing is, you can't log into the router even on a device that's not affected. The website address times out. 

the only cure is to unplug the Vodafone router from the mains and plug it back in then it's fine again. 

. The other night the router dropped 3 times around 2.30 am which is probably not related but a little odd as the router has never done that before. the only thing I notice is in the logs it keeps saying " possible DNS-rebind attack detected: dc.rm.skyq.info" 

On the sky forum, there is some reference about: dc.rm.skyq.info being blocked by a firewalls which then is blocking the sky paramount plus app 

anyone any ideas 

[Gemma]

@gipjon - thanks for explaining in details what's happening. This does sound frustrating and you shouldn't need to keep unplugging/restarting the router. I'd like us to look into this with you. Please can you contact my team through Social Media. 

[gipjon]

no thank you ,  it's way too technical for Vodafone staff to even understand what DNS-Rebind is 

[Jayach]

If you are unable to log into the router when it fails, it's either a faulty router, or one that is working so hard it can't service the request.

Next time it happens, disconnect the incoming line (DSL or Ethernet). If you can then log in it's probably not a router fault. If you still can't log in it may be a faulty router.

Do you have Sky Q?

[Cynric]

DNS rebind errors can also show-up if two devices on the LAN are trying to offer DNS services. Do any of the Sky products try to provide their own DNS? Alternatively have you something like a Pihole running and have forgotten to disable DNS in the router? This is a "clutching at straws" suggestion, so it may be not much help.

[gipjon]

I have got sky Q and a sky Q mini box both running on standard DNS control by the router but I also have sky go on a few devices, 

I know the wife has the sky paramount plus app installed on her tablet which according to the sky forum has links with the address  dc.rm.skyq.info 

[Cynric]

Elsewhere I have seen conversations regarding alternative DNS settings; e.g. Google, Cloudflare, Quad9 etc. that have shown some promise. Are you using VFs default DNS?

[gipjon]

running google dns in the router 

[Cynric]

Oh well, that's exhausted my knowledge of Sky Q related matters. Now if it was about ICL mainframes it'd be a different matter 😁

[CrimsonLiar]

@Cynric It's fair to say Sky Q and the minis cause problems all over.  I've a neighbour who has taken to only turning the minis on at the socket when they are wanted.

The call on multiple DNS when there are Q minis is probably a good one.  If the mini is providing an access point and a second DNS (either itself or via the main Q box) on the same IP address as the VF router that would indeed show as a rebind attack!

Interested to see where this goes!