DNS weirdness on IPCop for new laptop

[Note: The TL;DR is that am able to kludged this to get it to work, but I
would like some theories as to WHY it is seemingly hosed. I'm suspecting
that my AT&T cable modem / WAP has been pwn'd.]

I am running IPCop 1.4.21 on a RED+GREEN+BLUE configuration.

RED connects to an AT&T 2Wire cable modem / WAP that has DHCP enabled. The DHCP
is "required"* by the other AT&T devices that attach to it...a VoIP service
phone, and 2 set top boxes, one of them wireless. (* Well, AT&T technicians told
me that the 2Wire device had to have DHCP enabled for the other devices to work
properly. I've never tried it without it.) The DHCP assignment pool are at
least addresses restricted to the range of 192.168.1.0/24.

My NICs are assigned as follows:
    RED:   eth2:    192.168.1.72/24     (this is a fixed lease from AT&T 2Wire)
    GREEN: eth0:    192.168.41.1/24
    BLUE:  eth1:    192.168.42.1/24
Thus all red, green, and blue addresses are non-routable. The 2Wire does NAT.
(IPCop is probably also, although I haven't had any double-NAT'ing problems
with it, probably since I never use a VPN behind it; my work laptop connects
directly to the 2Wire and is the only place I use a VPN.)

DHCP is enabled on IPCop and generally I have assigned fixed leases for most
of our common devices. (That is mostly because it's easier for me to filter
IPCop logs on IPv4 addresses then it is to use MAC addresses.)

All was well with they world until yesterday when my son bought a new
Windows 10 laptop. I tweaked the privacy settings on it so as not to
share my WiFi password, etc. and configured IPCop to give him a fixed
DHCP less. (The assigned address was 192.168.42.15 and the assigned FQHN
was 'chris-laptop.localdomain'.) Originally, after I set it up into IPCop
for DHCP and added his fixed lease IP address and MAC address to the
'Firewall->Blue Access' page, things looked OK from IPCop side. I went
to his laptop (which only has WiFi) and noticed it was connected to my
WiFi Access Point on BLUE (and NOT the WAP on the AT&T 2Wire), but his
laptop said "No connection to the Internet". I was able to ping IPCop BLUE
interface and other IP addresses on BLUE (such as my laptop, planck), and
also able to traceroute (er, excuse me; Windoze 'tracert') to IPCop Blue, but
not beyond there. Couldn't even get to RED IPCop interface.

Then I remembered something from about a month earlier when I had gotten
a new phone and configured IPCop for it. I had the same problem until I
power-cycled the AT&T 2Wire. So I figured, WTF, worth a try. I did that,
and lo and behold, after a reboot, his laptop (chris-laptop) could now
connect to the Internet.  I patted myself on the back, but then wanted
to see if I could ping his laptop. So from my laptop, I tried
    kww@planck ~ $ ping chris-laptop
    PING chris-laptop.localdomain (198.105.254.130) 56(84) bytes of data.
    ^C
    --- chris-laptop.localdomain ping statistics ---
    8 packets transmitted, 0 received, 100% packet loss, time 7056ms

Hmm. That's mighty weird. Why does my laptop think the IPv4 address for
chris-laptop is 198.105.254.130 when I just set it on IPCop to the
fixed lease of 192.168.42.15 and that in fact is the IP address that
his laptop shows that it had associated with his WiFi NIC.

So, puzzled, I ssh'd into IPCop. and ran the following:

root@ipcop:~ # arp -a
chris-android-phone.localdomain (192.168.42.28) at 34:4D:F7:99:0D:14
[ether] on eth1
chris-laptop.localdomain (192.168.42.15) at B8:81:98:4F:DA:B2 [ether] on eth1
? (192.168.41.10) at 00:16:41:E9:D5:D2 [ether] on eth0
planck.localdomain (192.168.42.14) at 00:23:15:CC:21:74 [ether] on eth1
gateway.2wire.net (192.168.1.254) at 74:9D:DC:03:AA:31 [ether] on eth2
root@ipcop:~ # host chris-laptop
Chris-Laptop has address 198.105.244.130
Chris-Laptop has address 198.105.254.130
Host chris-laptop not found: 3(NXDOMAIN)
Host chris-laptop not found: 3(NXDOMAIN)
root@ipcop:~ # host 192.168.42.15
Host 15.42.168.192.in-addr.arpa. not found: 3(NXDOMAIN)
root@ipcop:~ # host 192.168.42.15
Host 15.42.168.192.in-addr.arpa. not found: 3(NXDOMAIN)

Note that it's correct in the ARP cache, but IPCop's DNS is confused
even though it's DHCP issued an IPv4 address for it as a fixed lease.
Weird.

But like I mentioned, meanwhile, on my son's new laptop, it is assigned IPv4
address 192.168.42.15 and everything seems to be working fine. (He did actually
give his laptop a different name (eoncho) from the Windows perspective, but I
don't think that has anything to do with this weirdness. (Indeed, 'host eoncho'
or 'host anythingNotInMyNetwork' returns the same IP addresses.) His laptop
can access the Internet just fine, so this is not an urgent problem and I
CAN access his laptop via the IPCop DHCP fixed lease I assigned to it
(192168.42.15), so that too is not a showstopper.

I did a bit of googling for these IP addresses and looks like this problem is
definitely related to the AT&T 2Wire device. E.g., see
https://www.dslreports.com/forum/r30093567-ATT-Re-routing-Router-Traffic-Home-LAN

The explaination there seems to be that someone has hijacked the router. I
suppose this is certainly possibly even though I had changed the Admin password
to something secure as well as the WiFi password. I mean, I'd say there's a
better than even chance it was vulnerable to bash shellshock bug or something
else even more serious (but I'm not sure how much worse it can get than to
have a vulnerability that allows remote command execution exploits).  But OTOH,
it could be an AT&T "feature" too. I can always reset it and see if that fixes
it. But if it got pwn'd, it's not likely to be a permanent fix anyhow as
based on the 2Wire 'Site Map', I see no way to update its firmware--assuming
that they even have a fix, which is unlikely. Otherwise, you would think
that AT&T would have remotely pushed out a patch for it...well, maybe not.
This is AT&T we're talking about.

Anyhow, does anyone have any ideas as to why this one laptop is giving me
a bogus IP address but none of my other devices are?  I have rebooted
his laptop, my WAP, IPCop, and the AT&T 2Wire several times, but that didn't
fix it.

Thanks,
-kevin
P.S.- I finally was able to fix this by using IPCop's Services->Edit Hosts
    and added it to the host list there. I was surprised that that actually
    worked and didn't try it earlier, because I had tried adding it to
    /etc/hosts on IPCop and that didn't work at all even though the
    /etc/nsswitch.conf has "hosts:  files dns". Must be a dnsmasq thing I
    guess. Would still like to know why AT&T 2Wire is highjacking my DNS
    though.
P.P.S- I just confirmed that other devices have apparently also been hijacked
    in a similar manner. This is not looking good at all. If this is a
"feature" of
    AT&T, I'll be looking for a new ISP.

-- 
Blog: http://off-the-wall-security.blogspot.com/    | Twitter: @KevinWWall
NSA: All your crypto bit are belong to us.

------------------------------------------------------------------------------
_______________________________________________
IPCop-user mailing list
[email protected]
Manage your subscription or unsubscribe
https://lists.sourceforge.net/lists/listinfo/ipcop-user