I'm running Debian 9.1 with KDE and when connecting to the Internet by default I get these two lines in my /etc/resolv.conf file:

  • search localdomain
  • nameserver {ipofmyrouter}

I guess that these - or at least "nameserver {ipofmyrouter}" - mean that my router somewhat acts as a nameserver(?) Afaik it caches DNS entries.

But isn't that a security vulnerability? Couldn't people change those DNS entry to reroute my traffic for eavesdropping? If so how can I prevent this? Should I disable this DNS functionality and if so how?

Please also consider that I wish to use a VPN and potentially OpenNIC and that I'm still relatively new to GNU+LINUX (and hence IT security) and I'm not sure whether this question would fit better on the unix.stackexchange.

2 Answers 2


This is not inherently a security problem and rather useful. Some routers do use the information they have at hand to generate domains for your local devices such as tv.lan, router.lan and pc.lan, thus simplifying inter-lan-connections and making them independent from ips (usually assigned via dhcp by the router also).

If an attacker gained access to your router, changing the answers of your routers dns-cache would be possible - but then again, rerouting whatever traffic comes for whatever IP would be, too.

So there is no significant gain in security from disabling your routers DNS (or not using it). It would just make your browsing experience a tiny bit slower.


That's not a vulnerability at all, that's the default behavior.

There's nothing you have to worry about, your router is acting as a DNS for you but it has no records (appart for the ones it already had to search in actual DNS servers). Also, no one can access this DNS functionality but you from your local network.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .