Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AT&T updates firmware to block access to 1.1.1.1

dslreports.com

Post reply on HN
Print view View original

191–200 of 382 posts

Re: AT&T updates firmware to block access to 1.1.1.1

#191

Post by utefan001 »

jjeaff wrote: post #87
jaas wrote: post #71

I'd say there is a 98% chance this is a bug in some firmware and a 2% chance AT&T is intentionally trying to block Cloudflare DNS. I get why people are paranoid about ISPs blocking content and net neutrality, but let's not cry wolf prematurely. The technical details here strongly suggest a bug rather than intentional blocking of 1.1.1.1 DNS traffic.

Then the odds appear to not be in our favor. CF CEO tweets that 1.0.0.1 is also blocked. https://twitter.com/eastdakota/status/991718955021623296 Others have confirmed that the ipv6 address belonging to CF appears to be blocked.

Reply from https://mobile.twitter.com/eastdakota/status/991718955021623...

@DnsLearningOrg Replying to @eastdakota and @ATTCares

This may be our fault. DnsLearning.org / StudyCity.org has implemented DNS servers with two modes. Study mode and Play mode. After 1 hour, "YourTube" and other play sites are blocked. 1/2

All you need to do is link your Khan Academy, DuoLingo or Mathopolis account with us and do 5 problems. DnsLearning / StudyCity.org will automatically detect when you earn points and switch your data center back to play mode. 2/2

Re: AT&T updates firmware to block access to 1.1.1.1

#192

Post by cbhl »

Zren wrote: post #145
blinkingled wrote: post #126

Earlier quoted context omitted.

You're using the IPV6 address correctly, does https://test-ipv6.com report everything's dandy for you? If it does maybe they're blocking traffic or there's something else going on.

> No IPv6 address detected. Connections to IPv6-only sites are timing out. Any web site that is IPv6 only, will appear to be down to you. Okay, guess my PC/LAN/ISP doesn't support IPv6 yet.

If you're in Ontario, Rogers doesn't support IPv6 yet. If you want IPv6, then your only option is Bell (or a reseller, like Teksavvy).

Re: AT&T updates firmware to block access to 1.1.1.1

#193

Post by Twirrim »

utefan001 wrote: post #191
jjeaff wrote: post #87

Earlier quoted context omitted.

Then the odds appear to not be in our favor. CF CEO tweets that 1.0.0.1 is also blocked. https://twitter.com/eastdakota/status/991718955021623296 Others have confirmed that the ipv6 address belonging to CF appears to be blocked.

Reply from https://mobile.twitter.com/eastdakota/status/991718955021623... @DnsLearningOrg Replying to @eastdakota and @ATTCares This may be our fault. DnsLearning.org / StudyCity.org has implemented DNS servers with two modes. Study mode and Play mode. After 1 hour, "YourTube" and other play sites are blocked. 1/2 All you need to do is link your Khan Academy, DuoLingo or Mathopolis account with us and do 5 problems.…

Not sure how that makes any sense whatsoever...?

Re: AT&T updates firmware to block access to 1.1.1.1

#194

Post by icebraining »

bb88 wrote: post #182
rrix2 wrote: post #154

Earlier quoted context omitted.

Who's advertising this when AT&T has a legal monopoly or duopoly in your town?

The arguments for anti-net-neutrality has basically come down to "let the free market sort it out." I don't agree with that, but if we can't have net neutrality, at least define to the customers what the "internet" means. And in that case, the town just lost it's internet. What makes you think the residents won't remember this come election day?

Except they haven't, really. They can still turn on their phone and login onto Facebook and watch stuff on YouTube. Someone telling them they no longer have Internet will just sound silly.

Re: AT&T updates firmware to block access to 1.1.1.1

#195

Post by chrissnell »

Some folks use a Ubiquiti EdgeRouter and a user-space proxy to forward EAP (authentication) packets to the AT&T router but otherwise use the EdgeRouter to route LAN traffic out to the ONT (fiber to Ethernet translator) and the internet, thus bypassing the shitty AT&T router for most stuff. This would be sufficient to ensure that 1.1.1.1 is reachable.

It's not a good solution for me, however, because I run PFSense, which is FreeBSD-based and lacks the PF_RING socket support to filter out those EAP packets. As far as I know, PFSense's PF packet filter cannot strain them out, either. Traditional libpcap is available on FreeBSD (slow) and netmap (fast), too. I looked into writing an EAP proxy in Go using a special netmap-enabled libpcap but it was way too much yak shaving and I eventually gave up. I should take another look, or maybe learn enough C to do it natively with netmap. My goal is native EAP proxy support for PFSense that can support filtering EAP out of a wirespeed gigabit fiber connection.

Re: AT&T updates firmware to block access to 1.1.1.1

#196

Post by utefan001 »

Twirrim wrote: post #193
utefan001 wrote: post #191

Earlier quoted context omitted.

Reply from https://mobile.twitter.com/eastdakota/status/991718955021623... @DnsLearningOrg Replying to @eastdakota and @ATTCares This may be our fault. DnsLearning.org / StudyCity.org has implemented DNS servers with two modes. Study mode and Play mode. After 1 hour, "YourTube" and other play sites are blocked. 1/2 All you need to do is link your Khan Academy, DuoLingo or Mathopolis account with us and do 5 problems.…

Not sure how that makes any sense whatsoever...?

Shameless plug.

Re: AT&T updates firmware to block access to 1.1.1.1

#198

Post by anilakar »

gaadd33 wrote: post #59
harshreality wrote: post #23

Earlier quoted context omitted.

They were blocking 1.1.1.1 on some firmwares long before cloudflare's dns service started. From what I've read, the routers use it on some internal interface. It's likely incompetence, not malice. If they didn't want people using other DNS, and were willing to fuck with ip addresses they don't own to accomplish that, they'd be blackholing google's and opendns's public caching nameservers too. It might even have been…

I like to use 33.0.0.0/8 for that stuff since I don't believe any of those IPs are available on the open internet.

My personal favorites are 44.128.0.0/16, the explicitly unallocated test network for amateur packet radio to internet gateways, and 100.64.0.0/10, the address range for bidirectional carrier grade NAT.
Post reply on HN