Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AT&T updates firmware to block access to 1.1.1.1

dslreports.com

Post reply on HN
Print view View original

311–320 of 382 posts

Re: AT&T updates firmware to block access to 1.1.1.1

#311

Post by lykr0n »

qrbLPHiKpiux wrote: post #261
csomar wrote: post #253

Earlier quoted context omitted.

Blocking 1.1.1.1 -> 98% chance it is a bug Blocking 1.1.1.1 and 1.0.0.1 -> what are the odds here?

Only one may be coincidental. Two is enemy action.

No. Block 1.0.0.0/8 due to internal use. That block includes both of those addresses.

Re: AT&T updates firmware to block access to 1.1.1.1

#312

Post by djsumdog »

craftkiller wrote: post #153
djsumdog wrote: post #102

Earlier quoted context omitted.

What's that saying about not attributing to malice, what is more easily explained as stupidity or incompetence or whatever? (Occom's Razon and all that). AT&T routers also don't let you use a 10.x address at home (possibly to prepare for carrier grade NAT, although there is an official 100.x address reserved for that; so fuck you ATT). I'm so sick of my AT&T router/modem for various other reasons. I hate how you are…

Wouldn't it be possible to use your own router and treat the AT&T router essentially like a modem? I ask because I'm about to move to an address that can get AT&T fiber.

Sort-of. It has a DMZPlus mode, but all it does is assign the public IP to an specific internal device and uses NAT, as well as forwarding all ports, to make it look like that device is onthe public Internet (even though the modem has the same public IP). You can still plug in other devices and they get private IPv4s or parts of your IPv6 prefix and it NATs (the IPv4) those as well (it's to support their VoIP phones and TV service).

It's a shitty hack and it adds a weird layer of indirection that's kinda buggy and doesn't always flow traffic the way you think it's being flowed. The IPv6 stuff gets confusing as well because the modem is still dishing out public IPv6 address, so if you want to advertise them as well, you've got to start slicing up your prefix.

Re: AT&T updates firmware to block access to 1.1.1.1

#313

Post by lightbyte »

ben174 wrote: post #139
tuna-piano wrote: post #131

Here is the original Cloudflare post on what 1.1.1.1 is [1]. For those who don't know, 1.1.1.1 is Cloudflare's privacy focused DNS service. That means that when you type in www.google.com, that URL can be sent to 1.1.1.1, and then 1.1.1.1 resolves that URL an IP address and send the IP back to the user. All user requests are then sent to the IP address, not the URL. Supposedly this is better than using the DNS server…

Got a link to the original hacker news article by chance? I’d like to see the comments

https://news.ycombinator.com/item?id=16727869

Re: AT&T updates firmware to block access to 1.1.1.1

#314

Post by hamandcheese »

skrause wrote: post #210
hamandcheese wrote: post #199

I really wish Cloudflare would have used a "normal" IP for their DNS service. That way there would be no confusion whatsoever as to whether this is malicious or a bug.

1.1.1.1 is a normal IP.

1.1.1.1 is widely known to be a dumping ground of random traffic, as well as a common internal address for captive portals and whatnot. The entire rollout of 1.1.1.1 has been characterized by legacy bugs and misconfigurations of network hardware preventing its proper use. Regardless of what the standards say about 1.1.1.1, it was a poor choice if Cloudflare values widespread adoption.

Re: AT&T updates firmware to block access to 1.1.1.1

#315

Post by ryan-c »

Late to the party, but here's some traceroutes run from AT&T Gigapower with their router entirely bypassed via an 802.1x MitM:

    # traceroute 1.0.0.1
    traceroute to 1.0.0.1 (1.0.0.1), 30 hops max, 60 byte packets
     1  45-18-124-1.lightspeed.austtx.sbcglobal.net (45.18.124.1)  59.462 ms  61.348 ms  63.373 ms
     2  71.149.77.208 (71.149.77.208)  1.304 ms  1.695 ms  1.957 ms
     3  75.8.128.136 (75.8.128.136)  1.329 ms  1.682 ms  1.393 ms
     4  12.83.68.145 (12.83.68.145)  2.673 ms  2.661 ms  2.648 ms
     5  12.123.18.233 (12.123.18.233)  8.877 ms  12.753 ms  8.800 ms
     6  192.205.36.206 (192.205.36.206)  6.663 ms  6.375 ms  6.680 ms
     7  66.110.56.158 (66.110.56.158)  6.885 ms  6.725 ms  6.436 ms
     8  1dot1dot1dot1.cloudflare-dns.com (1.0.0.1)  6.855 ms  6.557 ms  6.662 ms

    # traceroute 1.1.1.1
    traceroute to 1.1.1.1 (1.1.1.1), 30 hops max, 60 byte packets
     1  45-18-124-1.lightspeed.austtx.sbcglobal.net (45.18.124.1)  163.322 ms  163.927 ms  174.243 ms
     2  71.149.77.208 (71.149.77.208)  1.346 ms  1.779 ms  2.035 ms
     3  75.8.128.136 (75.8.128.136)  1.215 ms  1.214 ms  1.564 ms
     4  12.83.68.137 (12.83.68.137)  1.495 ms 12.83.68.145 (12.83.68.145)  2.289 ms 12.83.68.137 (12.83.68.137) 2.283 ms
     5  12.123.18.233 (12.123.18.233)  7.783 ms  11.766 ms  11.757 ms
     6  192.205.36.206 (192.205.36.206)  6.163 ms  6.160 ms  6.202 ms
     7  66.110.56.158 (66.110.56.158)  6.909 ms  6.931 ms  6.423 ms
     8  1dot1dot1dot1.cloudflare-dns.com (1.1.1.1)  6.922 ms  6.492 ms  7.075 ms

    ; > DiG 9.9.5-9+deb8u14-Debian > cloudflare.com @1.1.1.1
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER> DiG 9.9.5-9+deb8u14-Debian > cloudflare.com @1.0.0.1
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER
I'm not going to paste the output, but `curl https://1.1.1.1/` works as well.

Doesn't look like it's anything onn AT&T's internal network.

Re: AT&T updates firmware to block access to 1.1.1.1

#316

Post by [deleted] »

djsumdog wrote: post #105
js2 wrote: post #75

This is likely due to incompetence, not malice. FWIW, it’s possible to bypass AT&T’s router: https://github.com/jaysoffian/eap_proxy That said, I tried 1.1.1.1 and found I had to switch back to Google DNS since Cloudflare intentionally doesn’t support EDNS Client Subnet which was causing my AppleTV’s to have trouble loading content.

I've been meaning to try eap_proxy for a while. I've seen it mentioned several times. My ATT router doesn't get in my way enough to bother with it yet, but it still pisses me off they won't let me use a 10.x range at home. Also I've heard that their routers report your entire network topology back when they phone home.

[deleted]

Re: AT&T updates firmware to block access to 1.1.1.1

#317

Post by netsec_burn »

masklinn wrote: post #276
netsec_burn wrote: post #272

This isn't malice. AT&T has an internal IP they assigned to 1.1.1.1 because it was unused and they used it as an image caching proxy so it browsing the internet would feel faster on early phones. I've seen it when I was reverse engineering on Android a while back.

So it's not just malice but doubly so: they used an IP they didn't have the rights to and they're now blocking proper users of it.

They used an IP that was originally reserved for what reserved IP's are used for. Now that Cloudflare convinced 1.1.1.1 to be released, I'm sure AT&T wants service continuity and had to make this decision, which is well within their rights as an ISP. I dislike AT&T so if this was entirely opinion-based, I would be against them here. But this is a knee-jerk reaction to a well justified decision.

Re: AT&T updates firmware to block access to 1.1.1.1

#318

Post by justherefortart »

pedrosanta wrote: post #254

I would cancel any broadband contract of any ISP that did this when providing me a service. We need to stand up to these sort of things. (Disclaimer: I live in Europe though.)

You wouldn't when you don't have a better alternative.

Re: AT&T updates firmware to block access to 1.1.1.1

#319

Post by unethical_ban »

netsec_burn wrote: post #317
masklinn wrote: post #276

Earlier quoted context omitted.

So it's not just malice but doubly so: they used an IP they didn't have the rights to and they're now blocking proper users of it.

They used an IP that was originally reserved for what reserved IP's are used for. Now that Cloudflare convinced 1.1.1.1 to be released, I'm sure AT&T wants service continuity and had to make this decision, which is well within their rights as an ISP. I dislike AT&T so if this was entirely opinion-based, I would be against them here. But this is a knee-jerk reaction to a well justified decision.

It was not ever a reserved IP address in the proper sense. They should have used something from RFC1918.

Re: AT&T updates firmware to block access to 1.1.1.1

#320

Post by SmellyGeekBoy »

jdironman wrote: post #306
rbanffy wrote: post #271

Earlier quoted context omitted.

What kind of demented person uses 1.1.1.1, a routable public address since 2010, for internal addresses. What's wrong with 10.0.0.0/8 or 192.168/16?

I'm gonna guess they valued the aesthetics over the problems / conditions.

You'd think in that case they'd have gone with 10.10.10.10. Silly people.
Post reply on HN