Provide an option for blocking internal IP addresses

[ameshkov]

https://forum.adguard.com/index.php?threads/adguard-dns-discuss.18080/

Cannot block internal IP addresses - DNS responses containing IP addresses listed in RFC1918 should be filtered out to mitigate DNS Rebinding attacks. For example, if badstuff.attacker.com points to 192.168.1.1 then that response should be filtered out. (OpenDNS allows this option and adguard should too)

[dartraiden]

Also please make it customizable (for example, this VPN server resolves some domains as 10.0.0.0/8, so this address range should be excluded from rebind protection)

[ameshkov]

@dartraiden please note that you already can block IP addresses using custom rules:

• |10.* will block 10.0.0.0/8
• |192.168.* will block 192.168.0.0/16

etc

[EugeneOne1]

This has been implemented in version v0.107.67 with HaGeZi's DNS Rebind Protection filter.

[markuman]

Also please make it customizable (for example, this VPN server resolves some domains as 10.0.0.0/8, so this address range should be excluded from rebind protection)

This is somehow working ...
We got a public DNS record for git.domain.com with some public IPv4 value.
In our network (VPN), the intern DNS Server resolves a 10.x.x.x address.
AdGuardHome got [/domain.com/]10.10.10.1

So in vpn, we got a 10.x.x.x value, even with the activated HaGeZi's DNS Rebind Protection filter.

If it 10.0.0.0/8 would be excluded, you're subsceptible by rebind attacks against 10.0.0.0/8 IPs.