Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AT&T updates firmware to block access to 1.1.1.1

dslreports.com

Post reply on HN
Print view View original

61–70 of 382 posts

Re: AT&T updates firmware to block access to 1.1.1.1

#61

Post by jfoutz »

harshreality wrote: post #23
thaumasiotes wrote: post #9

Earlier quoted context omitted.

Are they blocking 8.8.8.8? Why do you think they're blocking 1.1.1.1?

They were blocking 1.1.1.1 on some firmwares long before cloudflare's dns service started. From what I've read, the routers use it on some internal interface. It's likely incompetence, not malice. If they didn't want people using other DNS, and were willing to fuck with ip addresses they don't own to accomplish that, they'd be blackholing google's and opendns's public caching nameservers too. It might even have been…

It’s weird at&t is in such poor technical shape that they can’t control a single ip address, and then just use that.

This was an organization that sustained five mines of uptime for decades.

Crazy to see a fallen (or broken up) titan struggle with basic stuff. I mean, basic compared to their heyday.

Re: AT&T updates firmware to block access to 1.1.1.1

#62

Post by wrigby »

derekp7 wrote: post #43
harshreality wrote: post #23

Earlier quoted context omitted.

They were blocking 1.1.1.1 on some firmwares long before cloudflare's dns service started. From what I've read, the routers use it on some internal interface. It's likely incompetence, not malice. If they didn't want people using other DNS, and were willing to fuck with ip addresses they don't own to accomplish that, they'd be blackholing google's and opendns's public caching nameservers too. It might even have been…

Whenever I've needed IP ranges for similar purposes (i.e., default IPs for container or VM internal / private networks) I've used ranges from RFC 5737 (192.0.2.0/24, 198.51.100.0/24, and 203.0.213.0/24). These are for reserved for documentation purposes, so it is highly unlikely that a customer would have these going in their own internal network. Not the best solution, but better than tying up a public /24 that we o…

We used to use RFC1918 (172.16/12 IIRC) addresses for the communication between internal nodes in a cluster-in-box system that I worked on, which worked great until we had a subnet collision on a customer's network. Leaves me wondering if link-local (169.254/16, fe80::/10) would have been a better option - while technically the customer could decide to make the external (customer-facing) network have a link-local interface, the chances of that configuration actually happening are pretty slim.

I'm still not entirely sure what the best option is there. Maybe some clever use of network namespaces, with a named pipe to bridge between the "internal" and "external" universes? Just typing up that idea makes me cringe though.

Re: AT&T updates firmware to block access to 1.1.1.1

#63

Post by 21 »

AgentK20 wrote: post #2

Cloudflare's CEO confirms: https://twitter.com/eastdakota/status/991718955021623296

The guy which himself banned a site from his service? Surely if he has the right to block others do to. After all, it's a free market and private companies are allowed to do what they want, you don't like it, go to someone else. Remember, only the government can censorship.

Re: AT&T updates firmware to block access to 1.1.1.1

#64

Post by bowersbros »

gaadd33 wrote: post #59
harshreality wrote: post #23

Earlier quoted context omitted.

They were blocking 1.1.1.1 on some firmwares long before cloudflare's dns service started. From what I've read, the routers use it on some internal interface. It's likely incompetence, not malice. If they didn't want people using other DNS, and were willing to fuck with ip addresses they don't own to accomplish that, they'd be blackholing google's and opendns's public caching nameservers too. It might even have been…

I like to use 33.0.0.0/8 for that stuff since I don't believe any of those IPs are available on the open internet.

I can't see anything about the 33.0.0.0/8 range being reserved

https://en.wikipedia.org/wiki/Reserved_IP_addresses

Re: AT&T updates firmware to block access to 1.1.1.1

#65

Post by kev009 »

Knowing how bad most telco networks are operated, I blithely wonder if maybe they were using stuff in 1./8 as PNI or some other privileged internal net and are going through some oh shit moments.

Hanlon's razor as lots of DNS services are available on not as vanity IP space, and there is no evidence of blockage.

Re: AT&T updates firmware to block access to 1.1.1.1

#66

Post by j605 »

fastball wrote: post #50

That's so crazy, I actually experienced this today. I've been using 1.1.1.1, and today went to the library for a quick work break. I pulled out my laptop and tried to connect to the wifi, and it wasn't working. After a few minutes of troubleshooting, I tried deleting my custom DNS entry in my network settings and that did the trick. I guess the library uses AT&T routers.

No, they use that for captive portals or broadcasts.

Re: AT&T updates firmware to block access to 1.1.1.1

#67

Post by desireco42 »

bb88 wrote: post #14
mabbo wrote: post #8

I wonder if anyone has considered some sort of legislation whereby internet service providers are not allowed to block or disrupt service to certain parts of the internet in order to promote their own business model.

The argument I've made is that if they're blocking certain parts of the internet, then they shouldn't be allowed to call themselves an Internet Service Provider.

Great point. Like at some point Hershey was on the verge to lose ability to call it's chocolate 'milk chocolate' because it's contents didn't have enough of it and cocoa.

I really love your idea.

Re: AT&T updates firmware to block access to 1.1.1.1

#68

Post by ddtaylor »

tptacek wrote: post #34
ddtaylor wrote: post #5

Earlier quoted context omitted.

For most people who aren't configuring DNSec or TLS can't the ISP still see all of the plain-text domain names in port 53 traffic?

DNSSEC doesn’t encrypt DNS traffic; it only signs it.

Derp, good point.

Re: AT&T updates firmware to block access to 1.1.1.1

#69

Post by jedberg »

My guess is this is just incompetence and not intentionally made to block CloudFlare.

I have one of those routers, and I couldn't use 1.1.1.1 because it was routing to an internal interface on the router. I confirmed this with ping, I was getting microsecond response times from 1.1.1.1.

Under the new firmware, 1.1.1.1 is just dead. So it's probably still connected to the local interface, and nothing is listening.

Re: AT&T updates firmware to block access to 1.1.1.1

#70

Post by sjwright »

21 wrote: post #63
AgentK20 wrote: post #2

Cloudflare's CEO confirms: https://twitter.com/eastdakota/status/991718955021623296

The guy which himself banned a site from his service? Surely if he has the right to block others do to. After all, it's a free market and private companies are allowed to do what they want, you don't like it, go to someone else. Remember, only the government can censorship.

Cloudflare are not a monopoly or duopoly. Cloudflare isn't a critical link in the chain between consumers and the wider internet. Being a Cloudflare customer isn't a necessary part of internet access.
Post reply on HN