OpenWRT's DNS server (dnsmasq) has DNS rebinding attack mitigations you can turn on. I'm not sure if they're on by default or not...