Custom domain name setup in router for local access?

Question

Recently I purchased a TP Link router for my home use, and in the instructions they said you can access router cPanel from http://tplinkwifi.net/ domain.

But I am confused on how they have done that? When I pinged the domain from my home, it says it is pinging to 192.168.0.1 but when I did the same from my office, it says ping: cannot resolve tplinkwifi.net: Unknown host.

How they added a custom domain name which works only in the local router environment? Can I do the same?

Also are there any such router models which support local domain setup so that I can setup any domain name and point it to my local IP Address.

I know a way by modifying the hosts file in Windows but that is a lengthy process any way of doing the same via router or any CMS system?

Please advise?

Solution 1

Depending on the model and administration interface you may or may not be able to add/modify DNS entries. What is happening is your computer receives the router as its primary DNS server through DHCP. The router either has a DNS server on it or has a hosts file that contains that address.

At no point will you be able to access that address outside of your local network because it is not a publicly registered domain.

If you want full control of DNS on your local network, you can setup bind9 on a raspberry pi and configure the router to point to it.

Solution 2

The router is intercepting and replying the DNS requests by itself.

DNS is the system that resolves a domain name like tplinkwifi.net into an IP address like 192.168.0.1. The protocol does not have any sort of encryption or security built in - your computer sends a DNS (plain-text) query to the DNS server, receives a (plain-text) response, and trusts it.

When using DHCP, your router can assign you which DNS' to use (a primary and a secondary one), but your computer can still override that.

In my case, my computer is connected to a TP-Link Archer C50 Router (192.168.3.253) over WiFi, getting its IP (192.168.3.200) via DHCP but with custom DNS servers set (8.8.8.8 and 8.8.4.4). The tplinkwifi.net is resolving to 192.168.3.253 (which is not a standard IP for the router to be, so the resolution is not fixed), and even if I perform a DNS query explicitly targeted at the 8.8.8.8 DNS server, I get an immediate response with the local IP:

$ dig @8.8.8.8 tplinkwifi.net

; <<>> DiG 9.10.6 <<>> @8.8.8.8 tplinkwifi.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48609
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;tplinkwifi.net.            IN  A

;; ANSWER SECTION:
tplinkwifi.net.     1   IN  A   192.168.3.253

;; Query time: 1 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed Jul 07 23:59:52 -03 2021
;; MSG SIZE  rcvd: 48

So the conclusion is that the Router is intercepting the DNS query for that name, and responding it by itself, impersonating 8.8.8.8. You can see the 1 msec response time (I'm on a really bad internet connection, pinging 8.8.8.8 gives 30ms at best), so it has to be the router forging the response.

You can finally check on Google Public DNS that the actual domain resolves to some other IP. To be able to visit that site, you should either connect to the Internet without going through a TP Link router that resolves this domain, hard-code those IPs on your local hosts file, or use DNS over HTTPs (DoH) to avoid the DNS query being intercepted by the router.

Comments

[Seth]

What name server is configured on your local/home machine? If it is the router it's as easy as just having him resolve that name locally instead of asking a "internet" DNS server.

[JW0914]

Linksys does the same... essentially, there's a custom route pre-programmed to send any requests to the address to localhost of the router, which is why it only works when you're connected to the LAN of the router. While you could do a port redirect to access this from WAN, it is never advised to do so, as a router's WebUI should never be accessible from WAN, unless its done so via SSH or a VPN tunnel (VPN server on the router, not a 3rd party VPN)