Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AT&T updates firmware to block access to 1.1.1.1

dslreports.com

Post reply on HN
Print view View original

21–30 of 382 posts

Re: AT&T updates firmware to block access to 1.1.1.1

#21

Post by bb88 »

noobermin wrote: post #12
AgentK20 wrote: post #2

Cloudflare's CEO confirms: https://twitter.com/eastdakota/status/991718955021623296

How is this not illegal?

Because as it stands right now, AT&T sells you access to their network. What happens on their network is for AT&T to decide. With the FCC striking down net neutrality [1], AT&T is probably testing out the waters.

[1] According to google, it's defined as:

"the principle that Internet service providers should enable access to all content and applications regardless of the source, and without favoring or blocking particular products or websites."

Re: AT&T updates firmware to block access to 1.1.1.1

#22

Post by briffle »

thaumasiotes wrote: post #9
mabbo wrote: post #8

I wonder if anyone has considered some sort of legislation whereby internet service providers are not allowed to block or disrupt service to certain parts of the internet in order to promote their own business model.

Are they blocking 8.8.8.8? Why do you think they're blocking 1.1.1.1?

I'm guessing they aren't blocking, but internally routing that ip that does not go where it should. Many cisco/Airspace wireless network gear would put the sign in network on 1.1.1.1

Re: AT&T updates firmware to block access to 1.1.1.1

#23

Post by harshreality »

thaumasiotes wrote: post #9
mabbo wrote: post #8

I wonder if anyone has considered some sort of legislation whereby internet service providers are not allowed to block or disrupt service to certain parts of the internet in order to promote their own business model.

Are they blocking 8.8.8.8? Why do you think they're blocking 1.1.1.1?

They were blocking 1.1.1.1 on some firmwares long before cloudflare's dns service started. From what I've read, the routers use it on some internal interface.

It's likely incompetence, not malice. If they didn't want people using other DNS, and were willing to fuck with ip addresses they don't own to accomplish that, they'd be blackholing google's and opendns's public caching nameservers too.

It might even have been a conscious decision. Even though it's horrible and the people involved in developing the firmware need re-education. The decision probably went like this: we need an internal address to do something. We can't use 10, 172.16, or 192.168 ranges because those might conflict with internal LANs. 1.x is safe because we all know nobody uses them. The correct decision obviously would have been to get at&t corporate to commit to never using some tiny corner of their address space, and use that. Or 127.a.b.c if that works on the OS. Those options are only needed if they really need an extra IP address. They might not need one after all if they designed their firmware better.

Re: AT&T updates firmware to block access to 1.1.1.1

#24

Post by dragonwriter »

noobermin wrote: post #12
AgentK20 wrote: post #2

Cloudflare's CEO confirms: https://twitter.com/eastdakota/status/991718955021623296

How is this not illegal?

> How is this not illegal?

Well, since the formal repeal of net neutrality has been delayed, I think it technically is a violation of the no-blocking rule.

OTOH, it's not like the FCC is enforcing net neutrality while delaying the official effect of its repeal.

Re: AT&T updates firmware to block access to 1.1.1.1

#25

Post by tinalumfoil »

mabbo wrote: post #11
thaumasiotes wrote: post #9

Earlier quoted context omitted.

Are they blocking 8.8.8.8? Why do you think they're blocking 1.1.1.1?

I think they'll block 8.8.8.8 if the anger for blocking 1.1.1.1 isn't too loud. I think they're blocking 1.1.1.1 because customers are now using DNS that isn't them, which deprives them of valuable data on which domain names their customers go to, which they can sell to advertisers. Yes, there's other ways to get that information but the DNS server is an easy one.

> I think they'll block 8.8.8.8 if the anger for blocking 1.1.1.1 isn't too loud.

On what basis? Google started Google Public DNS in 2009 and, as far as I know, it was never intentionally blocked by any ISPs. The issue with 1.1.1.1 is a lot of hardware treats it as though it was reserved for private networks. For instance, I can't access 1.1.1.1 right now since I'm connected to a Cisco router. So this could very well be a technical issue.

But even if 1.1.1.1 is taking off more than 8.8.8.8 did, your assuming the DNS queries people are sending are secure anyway. I'll admit I'm not completely up-to-date on the whole "DNS over TLS" thing but I haven't noticed any support for it on my fully-updated Windows machine or Android phone. I'd love for someone to correct me, but I don't believe any major electronics ship with secure DNS by default. If people are sending DNS queries unencrypted the ISPs can just sniff them.

Re: AT&T updates firmware to block access to 1.1.1.1

#26

Post by codetrotter »

techjuice wrote: post #3

I always thought it was strange to see the example loopback address listed as 1.1.1.1 or 1.xxx.xxx.xxx in many of tutorials and official network certification guides and why they did not use a private. This is more than likely why many users are having problems because they are being routed to a loopback address on their router or another router. Hopefully network admins and engineers will choose a non public ip spac…

Indeed. I wish most people used TEST-NET-1, TEST-NET-2 and TEST-NET-3 in documentation and training material.

RFC 5735:

> 192.0.2.0/24 - This block is assigned as "TEST-NET-1" for use in documentation and example code. It is often used in conjunction with domain names example.com or example.net in vendor and protocol documentation. As described in RFC5737, addresses within this block do not legitimately appear on the public Internet and can be used without any coordination with IANA or an Internet registry.

> 198.51.100.0/24 - This block is assigned as "TEST-NET-2" for use in documentation and example code. It is often used in conjunction with domain names example.com or example.net in vendor and protocol documentation. As described in RFC5737, addresses within this block do not legitimately appear on the public Internet and can be used without any coordination with IANA or an Internet registry.

> 203.0.113.0/24 - This block is assigned as "TEST-NET-3" for use in documentation and example code. It is often used in conjunction with domain names example.com or example.net in vendor and protocol documentation. As described in RFC5737, addresses within this block do not legitimately appear on the public Internet and can be used without any coordination with IANA or an Internet registry.

https://tools.ietf.org/html/rfc5735

Re: AT&T updates firmware to block access to 1.1.1.1

#27

Post by ReverseCold »

sxates wrote: post #7

Does this just apply to setting the default DNS on the router, or are the blocking traffic to 1.1.1.1 from any device connected to it?

I'm on ATT right now and I can't go to https://1.1.1.1 right now.

It works fine when I disable WiFi on my phone (Verizon).

Re: AT&T updates firmware to block access to 1.1.1.1

#28

Post by RKearney »

tinalumfoil wrote: post #25
mabbo wrote: post #11

Earlier quoted context omitted.

I think they'll block 8.8.8.8 if the anger for blocking 1.1.1.1 isn't too loud. I think they're blocking 1.1.1.1 because customers are now using DNS that isn't them, which deprives them of valuable data on which domain names their customers go to, which they can sell to advertisers. Yes, there's other ways to get that information but the DNS server is an easy one.

> I think they'll block 8.8.8.8 if the anger for blocking 1.1.1.1 isn't too loud. On what basis? Google started Google Public DNS in 2009 and, as far as I know, it was never intentionally blocked by any ISPs. The issue with 1.1.1.1 is a lot of hardware treats it as though it was reserved for private networks. For instance, I can't access 1.1.1.1 right now since I'm connected to a Cisco router. So this could very well…

> I can't access 1.1.1.1 right now since I'm connected to a Cisco router.

I've never seen or heard of a Cisco router doing anything that would interfere with access to 1.1.1.1.

Their wireless LAN controllers on the other hand, use 1.1.1.1 as the default (but entirely configurable) Virtual IP to use as an anchor for the captive portal.

If you can't access 1.1.1.1 behind a Cisco router it's likely because someone set it up incorrectly.

Re: AT&T updates firmware to block access to 1.1.1.1

#30

Post by ocdtrekkie »

techjuice wrote: post #3

I always thought it was strange to see the example loopback address listed as 1.1.1.1 or 1.xxx.xxx.xxx in many of tutorials and official network certification guides and why they did not use a private. This is more than likely why many users are having problems because they are being routed to a loopback address on their router or another router. Hopefully network admins and engineers will choose a non public ip spac…

Everything there is an example, not actual best practice. But a lot of admins probably just go with 'eh, my textbook used 1.1.1.1, so will I'.

Really the only place I saw 1.1.1.1 regularly though is to set the router ID, and making a loopback address is not the best way to do that to begin with.

Post reply on HN