Router does not resolve DNS queries for domains that map to private IPv4 address space?

[#1]

Hi,

I recently joined Plusnet and immediately my self-hosted services are not available when on the wifi (they work fine when I'm outside the house on mobile network). I use wireguard vpn and all my services are hosted on private IPv4 addresses (10.0.0.0) pointed to by public DNS entries.

I did some testing and discovered:

- My domains are resolved when querying Plusnet's own DNS servers, i.e. `dig @212.159.6.9 MYDOMAIN` gives the right answer

- My domains are NOT resolved when querying the router itself, i.e.`dig @192.168.1.254` MYDOMAIN` gives no answer section (return code is NOERROR).

I would guess the router itself refuses to resolve some (all?) private ranges. This was not the case with my previous provider (Virgin). Anybody else noticed this or found a way around it?

I will probably have to redesign my DNS, which is fine, but I could find no other threads on this so thought I'd bring it up.

There was one previous thread where a work VPN failed that could be the same reason, if the work VPN was also using private ranges. The OP there never got to bottom of it, they just switched to cloudflare for DNS (far as I can tell):

https://community.plus.net/t5/My-Router/Sudden-DNS-issue-with-work-VPN/td-p/2022083

Thanks for any and all insights.

[#2]

Does Router 192.168.1.254  offer a DNS service at its IP ?

Try a simple test :  nslookup hp.com 192.168.1.254

A similar test using the IP of a VM Hub 3 would fail, but a VM Hub 5 works

[#3]

@Broadbandian 

Not saying this is your issue, in July the plusnet DNS servers IP Addresses changed

Primary		213.120.234.38
Secondary	213.120.234.42

For more details see https://www.plus.net/help/broadband/about-dns-server-and-website-settings/ 

On the Hub two it is possible to define your preferred DNS servers.

[#4]

---

@PhilipHeyes wrote:

Does Router 192.168.1.254  offer a DNS service at its IP ?

Try a simple test :  nslookup hp.com 192.168.1.254

---

Looks like how I would expect if the router is answering queries itself?

$ nslookup hp.com 192.168.1.254

Server: 192.168.1.254

Address: 192.168.1.254#53

Non-authoritative answer:

Name: hp.com

Address: 18.239.50.109

Name: hp.com

Address: 18.239.50.6

Name: hp.com

Address: 18.239.50.112

Name: hp.com

Address: 18.239.50.45

[#5]

---

@Dan_the_Van wrote:

@Broadbandian 

Not saying this is your issue, in July the plusnet DNS servers IP Addresses changed

Primary		213.120.234.38
Secondary	213.120.234.42

For more details see https://www.plus.net/help/broadband/about-dns-server-and-website-settings/ 

On the Hub two it is possible to define your preferred DNS servers.

---

Understood - these DNS servers whether old or new are not the issue I think. In fact I tested those new ones you gave above and they give the right answer as well. I'm pretty convinced the router itself is checking DNS answers and withholding any for private IPv4 ranges. That would suggest even if I change the router to use third party DNS it won't work, but perhaps I should try that next.

(My router does not have those new DNS servers, even though it says it updated a few days ago?)

[#6]

Definitely not one to advocate pointing public DNS records at private IPs in the first place, but...

I'm confused by your Wireguard statement. How exactly are you using Wireguard, where is the VPN enpoint hosted, what IP ranges does it dish out, and what DNS servers is the tunnel configured to use?

I have just created a DNS record pointing to a local IP and queried it using the hub's DNS forwarder. It resolved the IP perfectly fine: -

~$ dig local.[REDACTED].net @192.168.1.254

; <<>> DiG 9.18.39-0ubuntu0.22.04.4-Ubuntu <<>> local.[REDACTED].net @192.168.1.254
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36519
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;local.[REDACTED].net.           IN      A

;; ANSWER SECTION:
local.[REDACTED].net.    272     IN      A       10.0.0.1

;; Query time: 20 msec
;; SERVER: 192.168.1.254#53(192.168.1.254) (UDP)
;; WHEN: Fri Sep 04 22:29:09 BST 2026
;; MSG SIZE  rcvd: 64

So the router does resolve domains that map to private IPv4 address space.

[#7]

---

@bobpullen wrote:

Definitely not one to advocate pointing public DNS records at private IPs in the first place

---

I'm finding out why this is bad idea it seems!

I'm confused by your Wireguard statement. How exactly are you using Wireguard, where is the VPN enpoint hosted, what IP ranges does it dish out, and what DNS servers is the tunnel configured to use?

The endpoint is a server at home, handing out IPs in the private range 10.10.0.1/32. The endpoint is reachable via dynamic dns. The tunnel has NO DNS configured. So I have been using public DNS to resolve hostnames. I don't have many hosts, so this has been manageable to this point and I figured simpler than also running my own DNS server. Seems like those calculations might have changed now(!)

---

I have just created a DNS record pointing to a local IP and queried it using the hub's DNS forwarder. It resolved the IP perfectly fine...[snip]...so the router does resolve domains that map to private IPv4 address space.

---

Thank you for doing that test that's really helpful. Are you using a hub two also? That and firmware are the only things I can think might be different between us, other than that I am using the `.uk` TLD but that shouldn't matter. Hmm.

Here's my `dig` output for completeness:

$ dig @192.168.1.254 [redacted].uk

; <<>> DiG 9.18.50 <<>> @192.168.1.254 [redacted].uk
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53858
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;[redacted].uk.                   IN      A

;; Query time: 10 msec
;; SERVER: 192.168.1.254#53(192.168.1.254) (UDP)
;; WHEN: Sun Sep 06 10:17:10 BST 2026
;; MSG SIZE  rcvd: 40