Re: DNS weirdness on IPCop for new laptop

On Thu, Jul 28, 2016 at 8:26 PM, Kevin W. Wall <[email protected]>
wrote:

> [Note: The TL;DR is that am able to kludged this to get it to work, but I
> would like some theories as to WHY it is seemingly hosed. I'm suspecting
> that my AT&T cable modem / WAP has been pwn'd.]
>
> I am running IPCop 1.4.21 on a RED+GREEN+BLUE configuration.
>
> RED connects to an AT&T 2Wire cable modem / WAP that has DHCP enabled. The
> DHCP
> is "required"* by the other AT&T devices that attach to it...a VoIP service
> phone, and 2 set top boxes, one of them wireless. (* Well, AT&T
> technicians told
> me that the 2Wire device had to have DHCP enabled for the other devices to
> work
> properly. I've never tried it without it.) The DHCP assignment pool are at
> least addresses restricted to the range of 192.168.1.0/24.
>
> My NICs are assigned as follows:
>     RED:   eth2:    192.168.1.72/24     (this is a fixed lease from AT&T
> 2Wire)
>     GREEN: eth0:    192.168.41.1/24
>     BLUE:  eth1:    192.168.42.1/24
> Thus all red, green, and blue addresses are non-routable. The 2Wire does
> NAT.
> (IPCop is probably also, although I haven't had any double-NAT'ing problems
> with it, probably since I never use a VPN behind it; my work laptop
> connects
> directly to the 2Wire and is the only place I use a VPN.)
>
> DHCP is enabled on IPCop and generally I have assigned fixed leases for
> most
> of our common devices. (That is mostly because it's easier for me to filter
> IPCop logs on IPv4 addresses then it is to use MAC addresses.)
>
> All was well with they world until yesterday when my son bought a new
> Windows 10 laptop. I tweaked the privacy settings on it so as not to
> share my WiFi password, etc. and configured IPCop to give him a fixed
> DHCP less. (The assigned address was 192.168.42.15 and the assigned FQHN
> was 'chris-laptop.localdomain'.) Originally, after I set it up into IPCop
> for DHCP and added his fixed lease IP address and MAC address to the
> 'Firewall->Blue Access' page, things looked OK from IPCop side. I went
> to his laptop (which only has WiFi) and noticed it was connected to my
> WiFi Access Point on BLUE (and NOT the WAP on the AT&T 2Wire), but his
> laptop said "No connection to the Internet". I was able to ping IPCop BLUE
> interface and other IP addresses on BLUE (such as my laptop, planck), and
> also able to traceroute (er, excuse me; Windoze 'tracert') to IPCop Blue,
> but
> not beyond there. Couldn't even get to RED IPCop interface.
>
> Then I remembered something from about a month earlier when I had gotten
> a new phone and configured IPCop for it. I had the same problem until I
> power-cycled the AT&T 2Wire. So I figured, WTF, worth a try. I did that,
> and lo and behold, after a reboot, his laptop (chris-laptop) could now
> connect to the Internet.  I patted myself on the back, but then wanted
> to see if I could ping his laptop. So from my laptop, I tried
>     kww@planck ~ $ ping chris-laptop
>     PING chris-laptop.localdomain (198.105.254.130) 56(84) bytes of data.
>     ^C
>     --- chris-laptop.localdomain ping statistics ---
>     8 packets transmitted, 0 received, 100% packet loss, time 7056ms
>
> Hmm. That's mighty weird. Why does my laptop think the IPv4 address for
> chris-laptop is 198.105.254.130 when I just set it on IPCop to the
> fixed lease of 192.168.42.15 and that in fact is the IP address that
> his laptop shows that it had associated with his WiFi NIC.
>
> So, puzzled, I ssh'd into IPCop. and ran the following:
>
> root@ipcop:~ # arp -a
> chris-android-phone.localdomain (192.168.42.28) at 34:4D:F7:99:0D:14
> [ether] on eth1
> chris-laptop.localdomain (192.168.42.15) at B8:81:98:4F:DA:B2 [ether] on
> eth1
> ? (192.168.41.10) at 00:16:41:E9:D5:D2 [ether] on eth0
> planck.localdomain (192.168.42.14) at 00:23:15:CC:21:74 [ether] on eth1
> gateway.2wire.net (192.168.1.254) at 74:9D:DC:03:AA:31 [ether] on eth2
> root@ipcop:~ # host chris-laptop
> Chris-Laptop has address 198.105.244.130
> Chris-Laptop has address 198.105.254.130
> Host chris-laptop not found: 3(NXDOMAIN)
> Host chris-laptop not found: 3(NXDOMAIN)
> root@ipcop:~ # host 192.168.42.15
> Host 15.42.168.192.in-addr.arpa. not found: 3(NXDOMAIN)
> root@ipcop:~ # host 192.168.42.15
> Host 15.42.168.192.in-addr.arpa. not found: 3(NXDOMAIN)
>
> Note that it's correct in the ARP cache, but IPCop's DNS is confused
> even though it's DHCP issued an IPv4 address for it as a fixed lease.
> Weird.
>
> But like I mentioned, meanwhile, on my son's new laptop, it is assigned
> IPv4
> address 192.168.42.15 and everything seems to be working fine. (He did
> actually
> give his laptop a different name (eoncho) from the Windows perspective,
> but I
> don't think that has anything to do with this weirdness. (Indeed, 'host
> eoncho'
> or 'host anythingNotInMyNetwork' returns the same IP addresses.) His laptop
> can access the Internet just fine, so this is not an urgent problem and I
> CAN access his laptop via the IPCop DHCP fixed lease I assigned to it
> (192168.42.15), so that too is not a showstopper.
>
> I did a bit of googling for these IP addresses and looks like this problem
> is
> definitely related to the AT&T 2Wire device. E.g., see
>
> https://www.dslreports.com/forum/r30093567-ATT-Re-routing-Router-Traffic-Home-LAN
>
> The explaination there seems to be that someone has hijacked the router. I
> suppose this is certainly possibly even though I had changed the Admin
> password
> to something secure as well as the WiFi password. I mean, I'd say there's a
> better than even chance it was vulnerable to bash shellshock bug or
> something
> else even more serious (but I'm not sure how much worse it can get than to
> have a vulnerability that allows remote command execution exploits).  But
> OTOH,
> it could be an AT&T "feature" too. I can always reset it and see if that
> fixes
> it. But if it got pwn'd, it's not likely to be a permanent fix anyhow as
> based on the 2Wire 'Site Map', I see no way to update its
> firmware--assuming
> that they even have a fix, which is unlikely. Otherwise, you would think
> that AT&T would have remotely pushed out a patch for it...well, maybe not.
> This is AT&T we're talking about.
>
> Anyhow, does anyone have any ideas as to why this one laptop is giving me
> a bogus IP address but none of my other devices are?  I have rebooted
> his laptop, my WAP, IPCop, and the AT&T 2Wire several times, but that
> didn't
> fix it.
>
> Thanks,
> -kevin
> P.S.- I finally was able to fix this by using IPCop's Services->Edit Hosts
>     and added it to the host list there. I was surprised that that actually
>     worked and didn't try it earlier, because I had tried adding it to
>     /etc/hosts on IPCop and that didn't work at all even though the
>     /etc/nsswitch.conf has "hosts:  files dns". Must be a dnsmasq thing I
>     guess. Would still like to know why AT&T 2Wire is highjacking my DNS
>     though.
> P.P.S- I just confirmed that other devices have apparently also been
> hijacked
>     in a similar manner. This is not looking good at all. If this is a
> "feature" of
>     AT&T, I'll be looking for a new ISP.
>
> --
> Blog: http://off-the-wall-security.blogspot.com/    | Twitter: @KevinWWall
> NSA: All your crypto bit are belong to us.
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> IPCop-user mailing list
> [email protected]
> Manage your subscription or unsubscribe
> https://lists.sourceforge.net/lists/listinfo/ipcop-user
>

Here's my .02 ...

I have the Motorola NG510 modem/router from ATT and have IP PassThrough set
to "pass everything through" to my IPCop (also running 1.4.21). The only
thing plugged into my NG510 is the IPCop machine. It does use DHCP to
assign an IP address to my IPCop, but when I view the IPCop System Home
page I see the external IP 99.x.x.x so I think the passthrough is working
properly.

I too have a couple of machines inside the IPCop network that are getting
the mysterious 198.105.244.130 address when resolved by name.

I also have a IPCop v2 setup at another location and I've not had this
phenomenon there... I was beginning to wonder if it was a 1.4 "thing"

Sorry not to be able to contribute more, but just wanted you to know that
you are not alone in this.

Thanks,

Ken

-- 
Kenneth Sims, Partner (http://about.me/kenpc)
Litho-Craft Printing, Office & School Supply
Ph: (423) 562-2296  Fax: (423) 562-2298
------------------------------------------------------------------------------
_______________________________________________
IPCop-user mailing list
[email protected]
Manage your subscription or unsubscribe
https://lists.sourceforge.net/lists/listinfo/ipcop-user