Multiple requests from apple.com on my adguard-home installed on a server.

[ghost]

I had multiple requests from apple.com and there's no apple device in my lan. What can it be?
My guess is antennapod, the podcast app. As client I see 194.3.0.0 which I don't understand why. How to set AGH in a way to see my LAN clients, like 192.168.1.xxx?

[o1x3]

Is your server publicly exposed?

[ghost]

If you mean having port 53 open then yes.

[ghost]

It got a lot worse today:
thousands of requests to apple.com:

[o1x3]

I had the same issue just yesterday. Closing port 53 incoming traffic fixed it. I only use DoH/DoT so it wasn't an issue for me

[ppfeufer]

You seem to have a public instance, so stuff like that is bound to happen and expected at some point.

[ghost]

I do, is it a security problem to run adh like that?

[ppfeufer]

Well, let's say, as I did that, my server hoster was contacted by the BSI (German Federal Office for Information Security) via mail which they patched through to me, so I had a little chat with them. Bottom line, they told me that I sure can run it like that, but it's not the best idea to do so and if something fishy (DNS poisoning and so on) happens through my public AGH instance I would be liable for it. So I moved it behind a VPN, as it's for my mobile devices only anyway, and I'm running a VPN on them now for this.

The AGH instance for my PC and anything else in my household that needs an internet connection is running on a Raspberry Pi in my network at home, and is not exposed publically at all.

So yeah, a public AGH instance is probably not the best idea, as it has the potential to temper with DNS resolution, as you can add your own DNS rewrites, which would be public as well. And I guess that is the part the BSI took an issue with.

[ghost]

Port closed, thanks for the detailed answer.