Option no logging PTR?

[TheCeet]

Is it possible to stop logging PTR requests?
Every 10 minutes I've got a mini tsunami *reverseIP*in-addr.arpa requests.

It will be handy that PTR requests are happening, but that they are not in the query log.

[ameshkov]

Hm, are they new all the time? It should've been caching results and not making requests for the same IP twice

[TheCeet]

Every 10min I get PTR requests from my devices.
See: https://imgur.com/a/V3VvCnb

I've 2 AdGuard Homes on 2 Raspberry Pi's.

[ameshkov]

@EugeneOne1 could you please take a look?

[TheCeet]

More screenshots:
This device it currently not anymore on the network. But it repeats every 10mins:
https://imgur.com/a/S4yzhpd

This device is 24/7 connected:
https://imgur.com/a/JueMhI0

I don't know if this is normal behaviour or not.
If yes, maybe it would be usefull if there's an option stop logging PTR requests in the querylog (if possible)

AdGuardHome version 0.105.2 on

• Raspberry PI OS on Pi4 (UTP)
• DietPI OS on Raspberry pi Zero W (wifi)

DNS upstream servers:
127.0.0.1:5335 (unbound)
[/168.192.in-addr.arpa/]192.168.50.1

[ameshkov]

Hmm, I guess we could make the re-check period considerably lower.

[EugeneOne1]

We've investigated the issue. These PTRs are coming from one of your AdGuard Home instances to the other. This is the expected behavior.

There is a feature request about searching the query log for specific requests' types. It may become an alternative solution for you since optional disabling of PTR logging doesn't really seem to be practical enough.

[ainar-g]

@dredjohn21, if you want to block processing of those completely, you can add the subnet domains to the domain blocklist on the DNS settings page. That makes AGH drop any queries for those domains immediately, before any processing takes place.

[dredjohn21]

@dredjohn21, if you want to block processing of those completely, you can add the subnet domains to the domain blocklist on the DNS settings page. That makes AGH drop any queries for those domains immediately, before any processing takes place.

Thanks for guidance. Newbie questions:

1. Does blocking prevent the activity? Or just stops logging? (I don’t want to break whatever my router is doing… just don’t want to see it/record it, if the group think is it is normal and benign)
2. “If” the blocking works as desired, do you have any coaching on how to block just the “in-addr.arpa” activity vs everything on the device? I’m assuming this is a regex activity, and haven’t done that before…

Appreciate the help!

[dredjohn21]

@ainar-g Brief update: I think I figured it out. I went to DNS Settings->Disallowed Domains and added a 4th entry:

version.bind
id.server
hostname.bind
*.in-addr.arpa

This has eliminated the logging (great news - thank you). And I'm also not noticing any issues with my network (great news). However, I'm not 100% clear on how these requests are being handled now.

The instruction state "AdGuard Home drops DNS queries matching these domains, and these queries don't even appear in the query log." Does this mean my router is no longer able to do these domain lookups? Or, it's performing the action, but AdGuard is just ignoring the activity?

Basically, just looking for professional reassurance I haven't messed up my system :)

[ainar-g]

Yes, that means that PTR queries are blocked completely. If you want to block only some of the queries, you can add the subnet ARPA domains there. For example, to block only the 192.168.X.Y lookups, add ||168.192.in-addr.arpa. And so on.

[dredjohn21]

Yes, that means that PTR queries are blocked completely. If you want to block only some of the queries, you can add the subnet ARPA domains there. For example, to block only the 192.168.X.Y lookups, add ||168.192.in-addr.arpa. And so on.

Thanks so much @ainar-g

I made that change and am now seeing some other traffic come through (I checked one and it was an Amazon AWS lookup)

I’m assuming this is better to ensure the right monitoring of external traffic

(and hope no issues will pop up with the disallow for internal lookups - still not 100% clear what is happening with those 192.168* lookups, but won’t dwell if I’m not noticing any issues)

Again appreciate your advice/help and hope if others stumble on this in future the guidance will be helpful