starred/AdGuardHome

Fork 0

mirror of https://github.com/AdguardTeam/AdGuardHome.git synced 2026-03-04 00:01:12 -05:00

Prevent HTTPS queries responding IPv6 addresses #4671

New issue

Closed

opened 2026-03-04 05:25:44 -05:00 by deekerman · 5 comments

deekerman commented

2026-03-04 05:25:44 -05:00

Owner

Originally created by @starryloki on GitHub (Aug 20, 2023).

Originally assigned to: @Mizzick on GitHub.

Prerequisites

I have checked the Wiki and Discussions and found no answer
I have searched other issues and found no duplicates
I want to report a bug and not ask a question or ask for help
I have set up AdGuard Home correctly and configured clients to use it. (Use the Discussions for help with installing and configuring clients.)

Platform (OS and CPU architecture)

Linux, AMD64 (aka x86_64)

Installation

GitHub releases or script from README

Setup

On one machine

AdGuard Home version

v0.107.36

Action

Example:

nslookup -debug -type=type65 'cdn.v2ex.com' '$YOUR_AGH_ADDRESS'

I have turned on Disable resolving of IPv6 addresses.

Expected result

HTTPS: 1 . alpn="h3,h2" ipv4hint="104.20.9.218,104.20.10.218,172.67.3.188"

Actual result

In AdGuard Home, I checked the DNS resolution records and found that the corresponding response is as follows:
HTTPS: 1 . alpn="h3,h2" ipv4hint="104.20.9.218,104.20.10.218,172.67.3.188" ipv6hint="2606:4700:10::6814:9da,2606:4700:10::6814:ada,2606:4700:10::ac43:3bc"

Just as described in "Disable resolving of IPv6 addresses", enabling it should result in blocking all IPv6 addresses, but it seems that only AAAA records are being blocked and not the IPv6 addresses within HTTPS records.
It appears that using HTTPS records allows for bypassing the restrictions on IPv6 resolution.

Additional information and/or screenshots

No response

Originally created by @starryloki on GitHub (Aug 20, 2023). Originally assigned to: @Mizzick on GitHub. ### Prerequisites - [X] I have checked the [Wiki](https://github.com/AdguardTeam/AdGuardHome/wiki) and [Discussions](https://github.com/AdguardTeam/AdGuardHome/discussions/categories/q-a) and found no answer - [X] I have searched other issues and found no duplicates - [X] I want to report a bug and not [ask a question or ask for help](https://github.com/AdguardTeam/AdGuardHome/discussions/categories/q-a) - [X] I have set up AdGuard Home correctly and [configured clients to use it](https://github.com/AdguardTeam/AdGuardHome/wiki/Clients). (Use the [Discussions](https://github.com/AdguardTeam/AdGuardHome/discussions/categories/q-a) for help with installing and configuring clients.) ### Platform (OS and CPU architecture) Linux, AMD64 (aka x86_64) ### Installation GitHub releases or script from README ### Setup On one machine ### AdGuard Home version v0.107.36 ### Action Example: ```sh nslookup -debug -type=type65 'cdn.v2ex.com' '$YOUR_AGH_ADDRESS' ``` I have turned on `Disable resolving of IPv6 addresses`. ### Expected result `HTTPS: 1 . alpn="h3,h2" ipv4hint="104.20.9.218,104.20.10.218,172.67.3.188"` ### Actual result In AdGuard Home, I checked the DNS resolution records and found that the corresponding response is as follows: `HTTPS: 1 . alpn="h3,h2" ipv4hint="104.20.9.218,104.20.10.218,172.67.3.188" ipv6hint="2606:4700:10::6814:9da,2606:4700:10::6814:ada,2606:4700:10::ac43:3bc" ` Just as described in "Disable resolving of IPv6 addresses", enabling it should result in blocking all IPv6 addresses, but it seems that only AAAA records are being blocked and not the IPv6 addresses within HTTPS records. It appears that using HTTPS records allows for bypassing the restrictions on IPv6 resolution. ### Additional information and/or screenshots _No response_

deekerman

2026-03-04 05:25:44 -05:00

closed this issue
added the
enhancement

P4: Low
labels

deekerman commented

2026-03-04 05:26:00 -05:00

Author

Owner

@duckxx commented on GitHub (Aug 20, 2023):

但是注释那里写的是：丢弃所有 IPv6 地址 (AAAA) 的 DNS 查询。
是禁止直接解析AAAA的记录，不包括HTTPS记录中的AAAA。

@duckxx commented on GitHub (Aug 20, 2023): 但是注释那里写的是：丢弃所有 IPv6 地址 (AAAA) 的 DNS 查询。是禁止直接解析AAAA的记录，不包括HTTPS记录中的AAAA。

deekerman commented

2026-03-04 05:26:00 -05:00

Author

Owner

@starryloki commented on GitHub (Aug 20, 2023):

但是注释那里写的是：丢弃所有 IPv6 地址 (AAAA) 的 DNS 查询。
是禁止直接解析aaaa的记录，不包括HTTPS记录。

I know that the comments have already provided an explanation. However, disabling AAAA records is a means to prevent IPv6 resolution. It is clear that with the widespread use of HTTPS records, this method is no longer effective in blocking IPv6 resolution. Therefore, it is necessary to update this option or similar filtering rules to address it.

@starryloki commented on GitHub (Aug 20, 2023): > 但是注释那里写的是：丢弃所有 IPv6 地址 (AAAA) 的 DNS 查询。 > 是禁止直接解析aaaa的记录，不包括HTTPS记录。 I know that the comments have already provided an explanation. However, disabling AAAA records is a means to prevent IPv6 resolution. It is clear that with the widespread use of HTTPS records, this method is no longer effective in blocking IPv6 resolution. Therefore, it is necessary to update this option or similar filtering rules to address it.

deekerman commented

2026-03-04 05:26:00 -05:00

Author

Owner

@fernvenue commented on GitHub (Aug 21, 2023):

Totally agree with @starryloki, just disable AAAA records seems not enough.

@fernvenue commented on GitHub (Aug 21, 2023): Totally agree with @starryloki, just disable AAAA records seems not enough.

deekerman commented

2026-03-04 05:26:00 -05:00

Author

Owner

@Mizzick commented on GitHub (Aug 23, 2023):

Please have a look, we have implemented the requested changes.
The new build version v0.108.0-a.657+cb6d4620 has been just published to the edge channel.

@Mizzick commented on GitHub (Aug 23, 2023): Please have a look, we have implemented the requested changes. The new build version `v0.108.0-a.657+cb6d4620` has been just published to the edge channel.

deekerman commented

2026-03-04 05:26:00 -05:00

Author

Owner

@starryloki commented on GitHub (Aug 23, 2023):

Please have a look, we have implemented the requested changes.
The new build version v0.108.0-a.657+cb6d4620 has been just published to the edge channel.

I have tested it on Linux amd64, and the new features are working fine!

@starryloki commented on GitHub (Aug 23, 2023): > Please have a look, we have implemented the requested changes. > The new build version `v0.108.0-a.657+cb6d4620` has been just published to the edge channel. I have tested it on Linux amd64, and the new features are working fine!

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/AdGuardHome#4671

No description provided.

Rows
Columns