Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AT&T updates firmware to block access to 1.1.1.1

dslreports.com

Post reply on HN
Print view View original

341–350 of 382 posts

Re: AT&T updates firmware to block access to 1.1.1.1

#341

Post by arbitrage »

xtf wrote: post #238

From https://en.wikipedia.org/wiki/1.1.1.1#Criticism_and_problems : Technological websites noted that by using 1.1.1.1 as the IP address for their service, Cloudflare created problems with existing setups. While 1.1.1.1 was not a reserved IP address, it was and is used by many existing routers (mostly those sold by Cisco Systems) and companies for hosting login pages to private networks, exit pages or other purposes,…

That's not a valid criticism; that's an excuse.

CloudFlare likely did this on purpose, because so many people can't get their heads out of their own asses and follow spec. Now there's a big spotlight on the people purposefully breaking the network. And it will be fixed, eventually, whereas previously, AT&T would have just said "take a hike".

Re: AT&T updates firmware to block access to 1.1.1.1

#342

Post by larrik »

ctdonath wrote: post #326
mabbo wrote: post #8

I wonder if anyone has considered some sort of legislation whereby internet service providers are not allowed to block or disrupt service to certain parts of the internet in order to promote their own business model.

Then take your business elsewhere. There are options.

There really aren't for most people.

Re: AT&T updates firmware to block access to 1.1.1.1

#343

Post by Zren »

cbhl wrote: post #192
Zren wrote: post #145

Earlier quoted context omitted.

> No IPv6 address detected. Connections to IPv6-only sites are timing out. Any web site that is IPv6 only, will appear to be down to you. Okay, guess my PC/LAN/ISP doesn't support IPv6 yet.

If you're in Ontario, Rogers doesn't support IPv6 yet. If you want IPv6, then your only option is Bell (or a reseller, like Teksavvy).

I'm using Bell in Ontario. It could be either my Router doesn't support it, the Apartment isn't wired up to support it (if that's required?), my ISP doesn't support it in my area, or my Bell internet plan doesn't cover IPv6...

I'll ask them about it when they ring me up next time asking for more money.

Re: AT&T updates firmware to block access to 1.1.1.1

#344

Post by mrpippy »

netsec_burn wrote: post #272

This isn't malice. AT&T has an internal IP they assigned to 1.1.1.1 because it was unused and they used it as an image caching proxy so it browsing the internet would feel faster on early phones. I've seen it when I was reverse engineering on Android a while back.

Was this on AT&T's wireless network or wireline DSL/fiber? This problem is about the wireline network/CPE.

Re: AT&T updates firmware to block access to 1.1.1.1

#345

Post by Phylter »

Piskvorrr wrote: post #302
Phylter wrote: post #179

Earlier quoted context omitted.

1.1.1.1 is well known (based on the announcement from cloudflare anyway) to have tons of random traffic. That's part of the reason it wasn't implemented by others as a valid address for anything. Could the fact that they're simply allowing traffic at that address cause additional stress on AT&T's network? I ask because I don't know. I figure any traffic headed that direction would go anyway it just wouldn't get route…

Yeah. And there's also a lot of traffic going in Facebook's direction, for example. Hey, let's blackhole that too - and alleviate the stress on our network that comes from people using it . (In non-sarcastic tone: that doesn't make any sense.)

Based on what I understand, the amount of traffic headed to 1.1.1.1 is much more significant. I agree with you though, that wouldn’t be justification to block it. It looks like they’re also blocking 1.0.0.1 and the relevant ipv6 addresses which shouldn’t have the same traffic issue.

Re: AT&T updates firmware to block access to 1.1.1.1

#346

Post by ryan-c »

criddell wrote: post #337
ryan-c wrote: post #315

Late to the party, but here's some traceroutes run from AT&T Gigapower with their router entirely bypassed via an 802.1x MitM: # traceroute 1.0.0.1 traceroute to 1.0.0.1 (1.0.0.1), 30 hops max, 60 byte packets 1 45-18-124-1.lightspeed.austtx.sbcglobal.net (45.18.124.1) 59.462 ms 61.348 ms 63.373 ms 2 71.149.77.208 (71.149.77.208) 1.304 ms 1.695 ms 1.957 ms 3 75.8.128.136 (75.8.128.136) 1.329 ms 1.682 ms 1.393 ms 4 12…

I have AT&T Gigapower as well (I'm also in Austin). Can you give a description of the 802.1x bypass? What's the advantage?

See http://www.dslreports.com/forum/r30708210-AT-T-Residential-G...

You can also do essentially the same thing with a userspace 802.1x proxy like this one: https://github.com/SeanMollet/1x_prox

Bypassing the router ensures that stupid router firmware does not do stupid things to my packets, such as special handling of public IPs.

Re: AT&T updates firmware to block access to 1.1.1.1

#347

Post by nickysielicki »

masklinn wrote: post #276
netsec_burn wrote: post #272

This isn't malice. AT&T has an internal IP they assigned to 1.1.1.1 because it was unused and they used it as an image caching proxy so it browsing the internet would feel faster on early phones. I've seen it when I was reverse engineering on Android a while back.

So it's not just malice but doubly so: they used an IP they didn't have the rights to and they're now blocking proper users of it.

AT&T regularly assigns my phone an IP in 10/8, instead of using 100.64/16 as they should [1]. IIRC, they used to even have the gall to use 172.16/12, which is crazy when you consider the amount of corporate networks using those addresses.

This caused issues where my phone would try to get on wifi, but the DHCPACK would be sent along on the existing interface rather than the one coming up. So the wifi icon was continually bouncing back and forth. My only solution was to go into airplane mode and bring the cellular down before bringing the wifi up. I don't think Android ever addressed this issue, and I had to switch around the entire subnet to avoid the conflicts.

If I knew enough about how Android worked, I'd write a patch to have all android interfaces in their own linux netns, with the dhcp client exec'd in that netns, that way you'd never have to worry about this sort of conflict.

[1]: https://tools.ietf.org/html/rfc6598

Re: AT&T updates firmware to block access to 1.1.1.1

#348

Post by abiox »

qrbLPHiKpiux wrote: post #261
csomar wrote: post #253

Earlier quoted context omitted.

Blocking 1.1.1.1 -> 98% chance it is a bug Blocking 1.1.1.1 and 1.0.0.1 -> what are the odds here?

Only one may be coincidental. Two is enemy action.

the problem with this sentiment is what "one" and "two" imply. it's possible to refer/block/whatever multiple addresses with "one" action.

Re: AT&T updates firmware to block access to 1.1.1.1

#349

Post by nickysielicki »

qmarchi wrote: post #323
netsec_burn wrote: post #317

Earlier quoted context omitted.

They used an IP that was originally reserved for what reserved IP's are used for. Now that Cloudflare convinced 1.1.1.1 to be released, I'm sure AT&T wants service continuity and had to make this decision, which is well within their rights as an ISP. I dislike AT&T so if this was entirely opinion-based, I would be against them here. But this is a knee-jerk reaction to a well justified decision.

Except that it wasn't classified as a private IP address. They should've use something like 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16. The 1.0.0.0/8 range was owned by IANA from _1981_ up until 2010, when it was transfered to APNIC. (The 2.0.0.0/8 range was also owned by IANA until 2010, thentransfered to RIPE NCC). If you want to get technical, use of the space could be construed as theft. As for the continuity i…

They should be using 100.64/10

https://tools.ietf.org/html/rfc6598

Re: AT&T updates firmware to block access to 1.1.1.1

#350

Post by Moru »

hvidgaard wrote: post #220
Moru wrote: post #212

Earlier quoted context omitted.

This is almost funny. We have the exact opposite problem in Sweden, it was just in the news today. One ISP has been convicted for allowing access to facebook even though the user has reached it's data limit for the month. This is unfair competition since the local swedish newspapers are still blocked when you reach your limit.

Look at it the other way around. They're blocking everything except Facebook. It's the same, but instead of 1 IP, they're blocking almost everything.

Yes, that is what I'm trying to say. They have been battling it out in court for two years and lost so far. Still free bandwidth for facebook though.
Post reply on HN