Fritzbox and IPv6 Reverse DNS

[moether]

I am evaluating blocky to replace PiHole. For me as a SW dev PiHole is an architectural over-designed nightmare - while I really like the simple yet powerful approach of blocky! Good job so far!

PiHole recently introduced a nice and for me (or my wife ;)) tremendously important feature: allow defining clients per Network MAC address, so that I can exclude certain devices in my network from ad-blocking. That one is working really nice.

Blocky allows to define excludes on host name basis which makes a Reverse DNS query necessary. This works fine for IPv4 queries together with my Fritzbox. But when it comes to IPv6 queries the FB never returns a hostname for a local IPv6 address.
Is this something you guys also experienced? I know it's not blocky's fault, but for it make it impossible to replace PiHole.

Not sure how PiHole does the MAC based filtering though...I have not yet found time to dig into their code.

[0xERR0R]

In blocky you can define the blocking groups based on the client name (determined via rDNS or defined manually) with or without wildcards, by using client's IP address or by defining an IP range (CIDR notation). I tried rDNS with IPv6 on FritzBox, but it didn't work properly.

Blocky receives only the IP from client and AFAIK you can't obtain the MAC address, but maybe I'm wrong. PiHole provides also a DHCP server, if you are using it, then PiHole has automatically the MAC from each client.

Do you use the DHCP server from PiHole or from your FritzBox?

I'll check the release notes from PiHole

[0xERR0R]

I found some information:

• Allow defining clients by their MAC address pi-hole/FTL#762
• Using MAC address for clients without enabling DHCP server AdguardTeam/AdGuardHome#961

Looks like it is possible to retrieve the MAC with APR protocol (IPv4) or NDP (IPv6).

I'll play a bit with this stuff.

[moether]

I am using the DHCP of the Fritzbox.

The rDNS for IPv4 works fine. Blocky correctly determines the hostname of the IP address the query came from. But for IPv6 it is not able to do that and the "client_name" in the logs is always set to the plain IPv6 address. So, defining just the client name is not good enough to assign a client a special filter rule - well, as long as IPv6 remains active in my local network.

Yes, ARP for IPv4 and NDP for the v6 equivalent can be used to determine the link layer address. And the link layer (MAC) address should unambiguously identify a client.

[0xERR0R]

Just testet rDNS with Ipv6 and FritzBox and it worked:
dig @192.168.178.1 -x IPv6address

Not sure, but maybe it was fixed witz FritzOs 7.26, there are some rDNS stuff in the change log

will check if it works with blocky

[0xERR0R]

It works with blocky, but only if client has a non-local address (not fe80...). Fritzbox can't resolve these addresses 😕

[moether]

The IPv6 stuff is a bit tricky. I just tried following on my RPi (where Blocky is supposed to run on)
The 2001 address is the public IPv6 address assigned to the RPi' network interface. Since yesterday I have FritzOS 7.27 installed.

pi@raspberrypi:~ $ dig +short -x 2001:16b8:28c5:e00:7f20:966e:XXXX:XXXX @192.168.178.1
--> no reply from Fritzbox

pi@raspberrypi:~ $ dig +short -x 2001:16b8:28c5:e00:7f20:966e:XXXX:XXXX
200116b828c50e007f20966e7aXXXXX.dip.versatel-1u1.de.
--> returns the correct hostname for the queried IPV6 address. But I guess this is been resolved by the RPIs local resolver stub and query never reaches the Fritzbox's DNS.

pi@raspberrypi:~ $ dig +short -x 192.168.178.20 @192.168.178.1
raspberrypi.fritz.box.
--> IPv4 works perfectly fine though

Did you do the same / similar testing?

[0xERR0R]

My raspberry pi has static ipv4 address configured. ifconfig shows only one ipv6 address (with fe80...). I see only fe80... addresses for client in blocky's log. I assume, I should configure also static ipv6 address in my pi and then publish it as DNS resolver for ipv6

[moether]

I use dynamic assignment of IPv4 and IPv6 on the Pi.
For IPv4 I made a static IP assignment in the DHCP settings of the Fritzbox and for IPv6 (in order to get a non-changing IPv6 address on the Pi) I enabled the "Unique Local Address immer zuweisen" under "Heimnetz -> Netzwerk -> Netzwerkeinstellungen ->IPv6 Einstellungen". The resulting FD00:: address on the Pi is published to all other clients as DNS server (where blocky is serving).
This is what is recommended in most PiHole tutorials like this one https://adminforge.de/dns/pi-hole-ipv6-und-die-fritzbox/

After this was done you will see from the blocky log prints that clients are sending the queries from their FD00::xx (ULA) address. But rDNS won't work for those too. At least for me.

[0xERR0R]

I'll try it this weekend. This stuff is really magic 😕

[moether]

I absolutely do agree! IPv6 itself is hard to understand. But Fritz DNS is even harder.
I just found that a normal DNS query works when I resolve a Windows Laptop hostname:

$ dig windowspc.fritz.box  @fritz.box AAAA +short                                                                                                                                                               
2001:16b8:28c5:xxx:xxxxx:xxxx:xxxx:xxxxxx
2001:16b8:28c5:xxx:xxxxx:xxxx:xxxx:xxxxxy

While doing the same against the Pi or my Linux Laptop, Fritzbox does not return anything:

$ dig raspberrypi.fritz.box  @fritz.box AAAA                                                                                                                                                                    

; <<>> DiG 9.16.15 <<>> raspberrypi.fritz.box @fritz.box AAAA
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7290
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;raspberrypi.fritz.box.		IN	AAAA

;; AUTHORITY SECTION:
fritz.box.		9	IN	SOA	fritz.box. admin.fritz.box. 1620401095 21600 1800 43200 10

;; Query time: 0 msec
;; SERVER: [fritzbox IP v6]
;; WHEN: Fr Mai 07 17:24:55 CEST 2021
;; MSG SIZE  rcvd: 81

And even more interesting: the reverse DNS search works for the windows machine too.

~ >>> dig -x 2001:16b8:28c5:xxx:xxxxx:xxxx:xxxx:xxxxxx  @fritz.box +short                                                                                                                                              
windowspc.fritz.box.

[0xERR0R]

Just tried the config with ULA prefix (fd22:2222:2222) and it works:

dig @192.168.178.1  pi3.fritz.box AAAA                                                                                                                                                    ...
;; ANSWER SECTION:
pi3.fritz.box.          9       IN      AAAA    2a02:590:505:4700:ff04:CENSORED
pi3.fritz.box.          9       IN      AAAA    fd22:2222:2222:0:187e:CENSORED

dig @192.168.178.1 -x fd22:2222:2222:0:187e:CENSORED                                                                                                                         ...
;; ANSWER SECTION:
CENSORED.e.7.8.1.0.0.0.0.2.2.2.2.2.2.2.2.2.2.d.f.ip6.arpa. 9 IN PTR pi3.fritz.box.

I configured the fd22 address from my pi (where blocky runs) in the FritzBox as DNSv6-Server ("DNSv6-Server auch über Router Advertisement bekanntgeben (RFC 5006)") and I can see client names in blocky's query log for IPv6 queries

[0xERR0R]

@moether If you're still searching for a solution: I had also some troubles with IPv6 and rDNS on FritzBox. I created this tool (https://github.com/0xERR0R/fritzbox-rdns). It fetches device information (name and all IP addresses) from the Web UI of the fritzbox.

[adb76]

@moether What helped for me on a similar setup was to add the following line for 0.0.d.f.ip6.arpa to the "conditional mapping":

conditional:
  mapping:
    fritz.box: 192.168.2.1
    2.168.192.in-addr.arpa: 192.168.2.1
    0.0.d.f.ip6.arpa: 192.168.2.1

with the following config in fritz.box:

Now also all IPv6 addresses in the logs are resolved.