New Router, OpenDNS sometimes reports IP different from my own

jimmyandrews · ‎10-01-2014

I recently traded in one of my routers for a new model of a different brand. I currently have a Linksys EA6500. I have been having a little difficulty with OpenDNS since, but I think that has something to do with the router settings and isn't my primary focus of this question (but is secondary). Today, while monitoring the connection to OpenDNS using the OpenDNS Updater on my PC, I noticed at times my IP as reported by OpenDNS will bounce between 192.105.254.24 and 192.105.244.24. Both have been allocated to HP at one time, the former is now allocated to Protek, LTD out of the UK (Scotland) and the latter is still allocated to HP out of Palo Alto, CA. Sometimes, a warning message comes up from the OpenDNS updater saying my IP is showing what it should, but my DNS requests are coming from one of the above 2 IPs, sometimes it shows my IP as one of the two, and others, it bounces back and forth very quickly between the two...

While testing the DNS settings on my new EA6500, I also noticed that I can only change the DNS on my local network DHCP and there are spaces for 3 IPs. I cannot change, from what I can see, the DNS settings on my ISP connection when DHCP is set (on my netgear router, I could override the ISP DNS). With the three IPs, if I fill in only the 2 provided by OpenDNS and leave the third blank, the OpenDNS Updater reports that I am not using OpenDNS for a majority of the time and the IP is not returned, it is just blank, but the internet works fine. To basically resolve that, I needed to put in one of the OpenDNS IPs in twice on the router settings. That particular problem all but disappeared (still happens on and off), but my biggest concern is still those apparent rogue IP addresses, in what appears to be a man-in-the-middle style scenario...

So, any ideas? I've included two screen shots showing both the IPs in question. Be gentle, I didn't obfuscate my IP address so you can see the differences.

image.png
image2.png

jimmyandrews · ‎10-01-2014

I have a forum thread open at Linksys as well, here: http://community.linksys.com/t5/Wireless-Routers/EA6500-intermittent-issues-with-OpenDNS/td-p/891047

rotblitz · ‎10-01-2014

"I think that has something to do with the router settings and isn't my primary focus of this question (but is secondary)."

No, it is the primary issue. Start with filling the DNS 3 entry on your router with one of 208.67.222.220 or 208.67.220.222. That should be it.

jimmyandrews · ‎10-02-2014

You didn't read my post then, been there, done that, said it in the post. That is why it is a secondary problem at this point.

jimmyandrews · ‎10-02-2014

Sorry, didn't mean to be so snappy. But these rogue IPs are really starting to make me scratch my head. Thank you for looking at the post and I appreciate any advice given.

rotblitz · ‎10-02-2014

No worries, you didn't say that you used these IP addresses.

Post the complete plain text output of the following diagnostic command:

nslookup -type=txt debug.opendns.com.

jimmyandrews · ‎10-02-2014

True, I didn't realize OpenDNS had more than the two they posted. In any event, here are some results.

___-=Behaving Properly:=-___

Server: AndrewsHome
Address: 10.10.10.1

Non-authoritative answer:
debug.opendns.com text =

"server 9.ash"
debug.opendns.com text =

"flags 20 0 2F6 0"
debug.opendns.com text =

"originid 20178101"
debug.opendns.com text =

"actype 2"
debug.opendns.com text =

"bundle 5816061"
debug.opendns.com text =

"source 96.32.61.5:46163"

___-=Misbehaving=-___(eg. bouncing between those public 192 addresses)

Server: AndrewsHome
Address: 10.10.10.1

*** AndrewsHome can't find debug.opendns.com.: Non-existent domain

___-=END=-___

rotblitz · ‎10-03-2014

In the first example you're using OpenDNS, their Ashburn/Virginia data center, through your router at 10.10.10.1, and your public IP address 96.32.61.5 is registered with OpenDNS network ID 20178101.

In the second example you still send your DNS query to your router at 10.10.10.1, but this doesn't use OpenDNS at all yet, but may send the DNS query to another DNS service. Only OpenDNS can resolve the domain debug.opendns.com. Therefore you get "AndrewsHome can't find debug.opendns.com.: Non-existent domain".

So, the question is, what happened to your router or to your internet connection between the two command outputs?

I took a look into your router's user guide from http://support.linksys.com/en-us/support/routers/EA6500/download

Just by chance, do you have dual-WAN, i.e. two different internet connections? What does the router status page say for the one and the other scenario?

Also, I can see that this router supports IPv6 connectivity. Ensure that you have disabled this, because you can register only an IPv4 address at OpenDNS yet, so your settings do not take effect when using IPv6. You may have non-OpenDNS IPv6 resolver addresses configured (or obtained automatically) which causes your DNS queries to go to a different service, as in your second command output.

Further, do you have VPN passthrough enabled in your router? This may be another reason for not using OpenDNS consistently.

And what consequences does this have on your computer? Post the following command output twice from your Windows computer, one for each scenario:

ipconfig /all

rotblitz · ‎10-03-2014

And while reviewing my own response: If you changed your router's DNS settings on the LAN DHCP side of the router as you did, your DNS queries should not be going to 10.10.10.1 at all, but the router would propagate the three OpenDNS resolver addresses via DHCP to the connected devices, and you would not see:

Server: AndrewsHome
Address: 10.10.10.1

but instead you would see e.g.:

Server: resolver1.opendns.com
Address: 208.67.222.222

Do you have the TCP/IP settings manually configured on your computer? If so, you must use only OpenDNS resolver addresses for DNS, never 10.10.10.1.

Therefore yes, post the "ipconfig /all" output for either situation.

kpatullo1 · ‎10-03-2014

We've also been seeing an issue with Linksys's recent firmware where the router does not respect the DNS settings you add to it. You can tell if this issue is affecting you by confirming that under Connectivity-->Local Network you have added OpenDNS's DNS settings to DNS 1-DNS 3 but when you check Troubleshooting-->Status you see your internet service provider's DNS for DNS1-DNS3. Even though you have OpenDNS configured your router is not respecting those settings. You can check your firmware version using the instructions here: http://support.linksys.com/en-us/support/ccc/CONNECTIVITY

In the cases that we have seen with this issue rolling back the firmware allowed OpenDNS to work properly, directions to rollback your firmware can be found here:

http://support.unblock-us.com/customer/portal/articles/1593108-linksys-smartwifi-routers---firmware-rollback

jimmyandrews · ‎10-03-2014

Excellent information, thank you rotblitz and Kristy. Kristy, you are correct about the DHCP DNS settings on the Linksys routers. I actually have a tandem post on the Linksys forums for this issue and the info I'm getting from them is exactly that, the DHCP DNS settings are not being passed to the clients (which I have subsequently complained about), and that is apparently by design. I have looked at my modem's config and it uses one of Google's DNS servers and 2 of Charters. I think way back when I got the modem, I configured that myself. But now with firmware updates pushed from Charter, those options are locked from being changed.

On my Netgear router, I was able to override the ISP DNS settings (from the DHCP of the ISP), so I never had an issue with OpenDNS regardless if the local DHCP DNS was configured for the gateway or the OpenDNS servers directly. On Linksys, this setting seems to be a hybrid of an override of the ISP DNS and local DHCP DNS, leaning more towards the ISP portion. But when I look over the detailed config, those pesky DNS settings on the modem keep showing up regardless of what I set in the Linksys config. I am working through a couple of troubleshooting steps with some of the community members over there to try and gather more information.

My client DNS is set to pull from DHCP. I do have IPv6 activated and was planning on turning it off anyhow because Charter does not support it. I do use VPN at times for work and I know how the OpenDNS Updater program reacts to that and it behaves as I would expect.

I have also enabled logging on OpenDNS to see if there is anything in those logs that could shed some light on the issue. The first day of logs didn't show anything standing out.

Right now, it seems as if that Linksys firmware could be to blame. My biggest concern still is why these particular IP addresses?

I'll get you the ipconfig output in a few. Thanks for all your help!

rotblitz · ‎10-03-2014

"the DHCP DNS settings are not being passed to the clients"

Oops, then the existence of this option is totally useless, good for nothing. :(

Therefore the fall-back to an older firmware version where this still worked is apparently the way to go until Linksys/Cisco will have fixed it if they want to do so at all.

I think I do not need your "ipconfig /all" anymore then.

jimmyandrews · ‎10-03-2014

ipconfig /all attached.

ipconfig_normal.txt

rotblitz · ‎10-04-2014

In your active internet connection "Wireless LAN adapter Wi-Fi":

DNS Servers . . . . . . . . . . . : 10.10.10.1

As I said and as expected, this contains your router's IP address, but should contain OpenDNS resolver addresses which you configured on the router, propagated by your router as DHCP server. The router doesn't do its DHCP job orderly. A true bug of the firmware.

Under these circumstances your only option to use OpenDNS is to configure the OpenDNS resolver addresses directly on the end user devices.
https://support.opendns.com/forums/21618384

Regarding your currently inactive connection "Ethernet adapter VirtualBox Host-Only Network", this can be disruptive for your use of OpenDNS when it becomes active, e.g. for using a VPN.

jimmyandrews · ‎10-09-2014

So it looks like it is certainly a firmware issue. This is my latest response to Linksys about the problem:

"How about you create a restriction, like a MAC filter, to make sure that unwanted users/IP address won't appear in your device list?"

Not the problem, this is a DHCP/DNS issue with the firmware. No rogue devices are connecting to the router, those rogue IPs that I referenced earlier are in between my connection and OpenDNS (aka man-in-the-middle). I live in a generally sparse area. Currently, I have the DNS addresses manually overridden on my PC, and everything is behaving as anticipated.

As far as other troubleshooting...
When connected directly to the modem, using the modems built-in DHCP when NOT connected to the internet, it will pass the DNS settings that I set up when I first got the modem (the option is currently locked due to Charter updating the firmware). When connected directly to the modem with the internet also connected, the computer gets a public IP from Charter and the DHCP settings are transferred from them as I would expect. Of course since Charter doesn't use OpenDNS, I don't get OpenDNS DNS options, so I need to manually assign those addresses to my DNS for OpenDNS to work (as expected).

I also understand how VPNs and VPCs work along with their networking, so everything on that front is behaving as anticipated. (Losing OpenDNS when connected to the VPN, VPCs are fine)

So the issue continues to point to the lack of DNS settings being propagated through DHCP, this firmware only pushes the gateway as the DNS address. This wouldn't be too big of an issue if the DNS overrides in the backend actually behaved as they should.

The short of it, DNS is broken in this current firmware and I'll be creating a ticket in the next couple of days. This is a HUGE security issue so I hope that Linksys will fix it.