# Add plex.direct to DNS rebinding

**URL:** <https://discourse.pi-hole.net/t/add-plex-direct-to-dns-rebinding/74780>\
**Category:** Help\
**Created:** [December 28, 2024, 10:19am UTC](https://discourse.pi-hole.net/t/add-plex-direct-to-dns-rebinding/74780 "2024-12-28T10:19:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![SecureBoot](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/secureboot/32/44759_2.png) [@SecureBoot](https://discourse.pi-hole.net/u/SecureBoot)\
**Post date:** [December 28, 2024, 10:19am UTC](https://discourse.pi-hole.net/t/add-plex-direct-to-dns-rebinding/74780/1 "2024-12-28T10:19:27Z")

</div>

##My question:  
How can I add plex.direct to dns rebinding rules in Pi-hole?

## Expected Behaviour:

When connected to the same LAN as my Plex server, I am unable to make a direct connection to the service. Some Googling indicates that adding rebind-domain-ok=/plex.direct/ to /etc/dnsmasq.d/99-custom.conf of Pi-hole will solve this issue.

(see [Plex Secure connections issues with DNS Rebinding. (Possible Fix!)](https://discourse.pi-hole.net/t/plex-secure-connections-issues-with-dns-rebinding-possible-fix/15240))

## Actual Behaviour:

Even after add the 99-custom.conf file, I am still unable to access Plex directly from the same LAN as the server.

## Debug Token:

[https://tricorder.pi-hole.net/D41Rj35C/](https://tricorder.pi-hole.net/D41Rj35C/)

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [December 28, 2024, 7:45pm UTC](https://discourse.pi-hole.net/t/add-plex-direct-to-dns-rebinding/74780/2 "2024-12-28T19:45:01Z")

</div>

Can you explain what you mean by 'unable to make a direct connection'? Rebind protection just allows a DNS record to be a local IP address instead of the actual IP address on the WAN internet.

Rebind protection isn't enabled by default with Pi-hole and typically it is something that would be managed be a router. Are you using a firewall application?

For instance this is on OPNsense:

 ![image](https://discourse.pi-hole.net/uploads/default/original/3X/6/6/663aa64d178c5bed43230975eb948399628daef0.png)

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [December 28, 2024, 7:53pm UTC](https://discourse.pi-hole.net/t/add-plex-direct-to-dns-rebinding/74780/3 "2024-12-28T19:53:10Z")

</div>

Your `pihole.log` shows that FTL does see your additional configuration line and is using it.

```conf
-rw-r--r-- 1 root root 31 Dec 28 08:15 /etc/dnsmasq.d/99-custom.conf
   rebind-domain-ok=/plex.direct/

```

```auto
   Dec 28 08:05:43 dnsmasq[2156]: using nameserver 8.8.8.8#53
   Dec 28 08:05:43 dnsmasq[2156]: using nameserver 8.8.4.4#53
   Dec 28 08:05:43 dnsmasq[2156]: using nameserver 192.168.254.254#53 for domain 254.168.192.in-addr.arpa 
   Dec 28 08:05:43 dnsmasq[2156]: using nameserver 192.168.254.254#53 for unqualified names 
   Dec 28 08:05:43 dnsmasq[2156]: using only locally-known addresses for plex.direct
   Dec 28 08:05:43 dnsmasq[2156]: using only locally-known addresses for onion
   Dec 28 08:05:43 dnsmasq[2156]: using only locally-known addresses for bind
   Dec 28 08:05:43 dnsmasq[2156]: using only locally-known addresses for invalid
   Dec 28 08:05:43 dnsmasq[2156]: using only locally-known addresses for localhost
   Dec 28 08:05:43 dnsmasq[2156]: using only locally-known addresses for test

```

What address is being returned from Pi-hole for `plex.direct`? I don't see where that address has been defined so I don't think there will be an answer for queries for `plex.direct`.

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [December 30, 2024, 9:33am UTC](https://discourse.pi-hole.net/t/add-plex-direct-to-dns-rebinding/74780/5 "2024-12-30T09:33:39Z")

</div>

In addition to Dan's explanations, your debug log shows that your Pi-hole machine is aware of another DNS server besides Pi-hole:

```auto
-rw-r--r-- 1 root root 259 Dec 28 08:15 /etc/resolv.conf
   nameserver 192.168.254.254
   nameserver 172.16.0.1
   search home

```

That `192.168.254.254`seems to be your router, and routers are likely to enable DNS rebind protection by default.  
So if clients would use your router for DNS, not only would they by-pass Pi-hole, but they may not be able to resolve `ip.*.plex.direct` domains.

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [January 20, 2025, 9:33am UTC](https://discourse.pi-hole.net/t/add-plex-direct-to-dns-rebinding/74780/6 "2025-01-20T09:33:47Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.