1

Profiles Being Overwritten and All Syncing to Single Profile

I have a specific NextDNS profile in my home used by my family and each device uses iOS app with  single profile.  I'm not using DynDNS to sync entire network IP. 

In the past month since release of new UI version of NextDNS on iOS which looks for login information, whenever visitors are also running NextDNS and joins my guest internal LAN (on same WAN), their NextDNS profile is suddenly synchronized across ALL my family devices on the same LAN.  This was a bit of a shock and some effort to correct once they left the LAN.

For example:  If you login to iOS app with specific account "A", app displays corresponding profile.  As soon as someone joins LAN with another device on the LAN with a different NextDNS account and profile "B", every device will switch to "B" profile on the LAN.  It seems like there's some evaluation of Public IP going on since this behavior doesn't occur until all devices are on the same public IP.

13 replies

null
    • NextDNs
    • 5 days ago
    • Reported - view

    What you describe isn’t possible with how NextDNS works.

    Profiles are local to each device (via its configured endpoint). One device joining your LAN cannot change another device’s profile.

    If all devices suddenly use the same profile, they are not using their individual app configuration anymore. Instead, everything is going through a shared network identity.

    Most likely causes:

    • Linked IP enabled → last device to refresh the IP forces its profile for the whole network
    • Router or Wi-Fi overriding DNS
    • App not active on some devices → fallback to network DNS

    The “only happens when all devices share the same public IP” strongly points to an IP-based configuration (Linked IP or router DNS).

    Check on an affected device: https://test.nextdns.io
    If you see UDP as protocol or the same profile everywhere, that confirms it.

    • Rick_mcdonald
    • 4 days ago
    • Reported - view

    Normally I would agree with you but the evidence is convincing and frankly just plain weird. 

    I have installed NextDNS on another "vanilla" iOS device and ensured it had no pre-saved passwords and not logged into same iCloud account. One I take a device, add my profile ID then link the account, everything looks good on Device A.  Then on Device B (vanilla setup) I add a different profile ID under a different email account.  I don't even link the account on Device B. Within 15 min, device B mirrors Device A.  It frankly makes me so angry this is security violation so much so that after years of great service I'm evaluating other DNS tools.

    • Rick_mcdonald
    • 4 days ago
    • Reported - view

    Missed last point.  I'll triple check no linked IP's and router not using NextDNS DNS IP

    • Rick_mcdonald
    • 4 days ago
    • Reported - view

    The last few lines of your suggestion seemed to point me in the right direction.  Thank you for your patience and understanding. 

    I've narrowed the problem down to something in iOS and new NextDNS app.  When 2 devices are using the same iCloud account, when you setup each device on NextDNS app with different profiles on different accounts, the last most login will sync all previous devices.  There's no warning that this occurs and I physically saw the switchover change "profile" in real-time with https://test.nextdns.io

    I'm not sure if this is intended phenomenon but it does present some problems.

    • Rick_mcdonald
    • 4 days ago
    • Reported - view

    When test device was removed from iCloud account, then both devices retain their intended profiles with normal behaviour.

    • Rick_mcdonald
    • 4 days ago
    • Reported - view

    Success.  Running 2 devices on same iCloud account...Removing the saved passwords for both NextDNS accounts.  Both devices held their profiles.

    So begs the question:  Why is iOS app automatically logging in with a different profile without some form of user input/confirmation.

    • Rick_mcdonald
    • 4 days ago
    • Reported - view

    **Sigh** Seems I spoke too soon.  Within 15 min both devices synched profiles again.  I'm at a loss how this can happen.  Both protocols are  DOH  (not UDP) so I assume configured correctly.  This new version of the app has to the source of issue.

    • Rick_mcdonald
    • 4 days ago
    • Reported - view

    This is easy to duplicate now.  Get 2 phones on same iCloud.  On one phone, select "Create a profile".  Wait 2-5 min.  Restart app on the other phone.  The other phone now will display thew same newly created profile.

      • NextDNs
      • 4 days ago
      • Reported - view

       if they all share the same keychain, the account will be automatically synchromized between phones. The profile selection stays local to each phone. By default it will just pick the first one when setup on another phone.

      • Rick_mcdonald
      • 3 days ago
      • Reported - view

       Thanks for replying and confirming as it aligns with what I'm seeing.  Yes the 2 devices I tested do share same keychains (synched via iCloud) but I can't recall ever encountered an App before where an account login was automatically synchronized between devices without having to manually confirm the login credentials on those subsequent devices. 

      Are there any plans to introduce a means to mitigate this synchronization, or was it purposely architected this way?

      • NextDNs
      • 3 days ago
      • Reported - view

       Yes, this is by design. Could you elaborate on why it is not what you expected? Isn’t having those credentials synchronised the whole point of enabling iCloud Keychain?

      • Rick_mcdonald
      • 3 days ago
      • Reported - view

       The issue is that in my family we have different NextDNS accounts with profile (kids, wife, myself).  It was intentional to keep them all separate.  Some family members share the same iCloud account even though they typically have different NextDNS logins and profile  (kids are heavily restricted, my wife and I less so).  With multiple NextDNS accounts saved in iOS keychain, it was unexpected and problematic that logging into one account would force all the others on same iCloud to switch over.  I discovered this by accident when my kids got into something the shouldn't have.  And I found it surprising behaviour that I've never seen before.  

      • NextDNs
      • 2 days ago
      • Reported - view

       I see. Any reason for not having an apple id per person setup as a family? I’m surprised it is the first time it happens. We use standard Apple APIs as intended.

Login to reply

Content aside

  • 1 Votes
  • 2 days agoLast active
  • 13Replies
  • 127Views
  • 2 Following