Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AT&T updates firmware to block access to 1.1.1.1

dslreports.com

Post reply on HN
Print view View original

111–120 of 382 posts

Re: AT&T updates firmware to block access to 1.1.1.1

#111

Post by sterlind »

jaas wrote: post #71

I'd say there is a 98% chance this is a bug in some firmware and a 2% chance AT&T is intentionally trying to block Cloudflare DNS. I get why people are paranoid about ISPs blocking content and net neutrality, but let's not cry wolf prematurely. The technical details here strongly suggest a bug rather than intentional blocking of 1.1.1.1 DNS traffic.

Anyone work at AT&T who could give us the inside scoop on these firmware changes? Snapping a photo of the blocking code would be a valuable public service.

Remember to scrub EXIF data!

Re: AT&T updates firmware to block access to 1.1.1.1

#112

Post by zxcvhjkl »

intrasight wrote: post #72

As a consumer, you are free to switch to a different provider. I'm not saying what they're doing is ok, but let's not neglect the opportunity to vote with our $$$.

I wish it was true. Where I live it’s either Comcast or ATT.

Comcast will happily block ports to “protect” me:

https://www.xfinity.com/support/articles/list-of-blocked-por...

Re: AT&T updates firmware to block access to 1.1.1.1

#113

Post by dzhiurgis »

robomc wrote: post #57
DoofusOfDeath wrote: post #53

Earlier quoted context omitted.

A court might.

but they'd just call themselves a "networking communications service provider" or something, or call themselves nothing, and people will still just use them.

You can call yourself whatever you want, but these are the regulations.

Re: AT&T updates firmware to block access to 1.1.1.1

#114

Post by c0nducktr »

mischov wrote: post #95
jaas wrote: post #71

I'd say there is a 98% chance this is a bug in some firmware and a 2% chance AT&T is intentionally trying to block Cloudflare DNS. I get why people are paranoid about ISPs blocking content and net neutrality, but let's not cry wolf prematurely. The technical details here strongly suggest a bug rather than intentional blocking of 1.1.1.1 DNS traffic.

1.1.1.1 was working for me on AT&T after Cloudflare released 1.1.1.1, then shortly after that it ceased working. Maybe the firmware update has a bug, but it's very suspiciously timed. Notice that the OP is dated April 2, while 1.1.1.1 was released April 1.

This is what happened to me as well. It worked for a day or so and then stopped.

I have ATT U-verse internet service and use their Arris BGW210-700 gateway

One interesting thing is that if I go to the gateway management page, and use their diagnostic tools, I'm able to ping / traceroute the address - but I can't from any devices connected to the gateway

From gateway diag page:

PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=64 time=0.568 ms 64 bytes from 1.1.1.1: seq=1 ttl=64 time=0.156 ms 64 bytes from 1.1.1.1: seq=2 ttl=64 time=0.164 ms 64 bytes from 1.1.1.1: seq=3 ttl=64 time=0.144 ms

--- 1.1.1.1 ping statistics --- 4 packets transmitted, 4 packets received, 0% packet loss round-trip min/avg/max = 0.144/0.258/0.568 ms

traceroute to 1.1.1.1 (1.1.1.1), 30 hops max, 38 byte packets 1 1dot1dot1dot1.cloudflare-dns.com (1.1.1.1) 0.285 ms 0.177 ms 0.090 ms

The times on the pings make it look like its hitting a loopback address instead. Pings to 8.8.8.8 from the diagnostics page take about 23 ms. No way 1.1.1.1 is completing in under 1ms haha

Re: AT&T updates firmware to block access to 1.1.1.1

#115

Post by mortenjorck »

sjwright wrote: post #88
jaas wrote: post #71

I'd say there is a 98% chance this is a bug in some firmware and a 2% chance AT&T is intentionally trying to block Cloudflare DNS. I get why people are paranoid about ISPs blocking content and net neutrality, but let's not cry wolf prematurely. The technical details here strongly suggest a bug rather than intentional blocking of 1.1.1.1 DNS traffic.

Having it seem like a bug would be an effective way to block it intentionally. The timing of such an unusual regression is suspicious. The fact that 1.0.0.1 is also blocked is also suspicious.

A conspiratorial Hanlon's corollary: The most effective malice is that which can be ascribed to incompetence.

Re: AT&T updates firmware to block access to 1.1.1.1

#116

Post by InitialLastName »

trumped wrote: post #98
jaas wrote: post #71

I'd say there is a 98% chance this is a bug in some firmware and a 2% chance AT&T is intentionally trying to block Cloudflare DNS. I get why people are paranoid about ISPs blocking content and net neutrality, but let's not cry wolf prematurely. The technical details here strongly suggest a bug rather than intentional blocking of 1.1.1.1 DNS traffic.

You could swap out those two odds and you would be just as right...

They could swap those odds with anything but 100% to 0% and they would still be just as "right" once the answer comes out.

Re: AT&T updates firmware to block access to 1.1.1.1

#117

Post by zylent »

techjuice wrote: post #3

I always thought it was strange to see the example loopback address listed as 1.1.1.1 or 1.xxx.xxx.xxx in many of tutorials and official network certification guides and why they did not use a private. This is more than likely why many users are having problems because they are being routed to a loopback address on their router or another router. Hopefully network admins and engineers will choose a non public ip spac…

network engineer here, most places I have worked at have used 10.1.x.x for loopback / underlay networks.

Re: AT&T updates firmware to block access to 1.1.1.1

#118

Post by Zren »

_bxg1 wrote: post #97
jjeaff wrote: post #87

Earlier quoted context omitted.

Then the odds appear to not be in our favor. CF CEO tweets that 1.0.0.1 is also blocked. https://twitter.com/eastdakota/status/991718955021623296 Others have confirmed that the ipv6 address belonging to CF appears to be blocked.

Do you have a reference for the ipv6 address being blocked? That would be a much bigger smoking gun

https://blog.cloudflare.com/dns-resolver-1-1-1-1/

> For IPv6, we have chosen 2606:4700:4700::1111 and 2606:4700:4700::1001 for our service. It’s not as easy to get cool IPv6 addresses; however, we’ve picked an address that only uses digits.

For me up in Canada, ping 1.1.1.1 works. But

    ping6 2606:4700:4700::1111
    ping6 2606:4700:4700::1001
shows "connect: Network is unreachable". Am I using ping6 wrong?

We also need to confirm IPV6 works outside AT&T's network.

Edit: Just tried Google's DNS. 8.8.8.8 works, but their IPv6 doesn't, so I guess this was a bad test.

Edit2: Learned about nslookup, but it does not seem to work with either Google or CloudFlare's DNS.

    nslookup reddit.com                       # Works
    nslookup reddit.com 1.1.1.1               # Works
    nslookup reddit.com 1.0.0.1               # Works
    nslookup reddit.com 2606:4700:4700::1111  # Does not
    nslookup reddit.com 8.8.8.8               # Works
    nslookup reddit.com 2001:4860:4860::8888         # Does not
    nslookup reddit.com 2001:4860:4860:0:0:0:0:8888  # Does not
Edit3: Apparently my ISP doesn't support IPv6 yet.

Re: AT&T updates firmware to block access to 1.1.1.1

#119

Post by brownbat »

sjwright wrote: post #88
jaas wrote: post #71

I'd say there is a 98% chance this is a bug in some firmware and a 2% chance AT&T is intentionally trying to block Cloudflare DNS. I get why people are paranoid about ISPs blocking content and net neutrality, but let's not cry wolf prematurely. The technical details here strongly suggest a bug rather than intentional blocking of 1.1.1.1 DNS traffic.

Having it seem like a bug would be an effective way to block it intentionally. The timing of such an unusual regression is suspicious. The fact that 1.0.0.1 is also blocked is also suspicious.

> Having it seem like a bug would be an effective way to block it intentionally.

Just like how only the true messiah denies his divinity, it doesn't give innocent bugs much of a chance.

In fact, now we can show that all bugs are suspicious, with apologies to the interesting number paradox:

The least intentional looking bug is the most effectively hidden, and therefore should probably be suspected of being intentional. Since it's now suspect, it's longer the least intentional looking bug, so the next least suspicious bug suddenly deserves a bit more scrutiny, and so on.

Re: AT&T updates firmware to block access to 1.1.1.1

#120

Post by mmilano »

johnvega wrote: post #91

If at&t does not provide any official explanation, what's your opinion on how people should respond. The first thing that came to mind for me is to switch over to Xfinity on my next contract cycle.

Boycott all AT&T services we can if they are blocking. Mobile + DirecTV too.
Post reply on HN