RV340W: Many logs/ unstable internet connection

ed_grit · ‎10-04-2021

Hey everyone,

for 2 years we have severe internet problems at home. Most of the day, the internet works fine, but sometimes it does work poorly or not at all for a few minutes (sometimes for 3mins, sometimes even for 30mins).

Router: RV340W

Firmware: 1.0.03.22 (latest version)

Location: Germany

WAN1: fritzbox/ network operator: Telekom

WAN2: fritzbox/ network operator: Vodafone

Since we have experienced a bad internet connection for a while now, I checked the log files. Many error messages have been produced. Therefore, today, I decided to update the firmware. Since the update, the following new logs were created (they are very similar to the logs before the firmware update):

2021-10-04T17:22:43+01:00 <warning>kernel: [ 3372.157354] fp_netfilter_pre_routing: 2 callbacks suppressed
2021-10-04T17:22:31+01:00 <warning>kernel: [ 3360.097725] fp_netfilter_pre_routing: 2 callbacks suppressed
2021-10-04T17:22:11+01:00 <warning>kernel: [ 3340.337648] fp_netfilter_pre_routing: 14 callbacks suppressed
2021-10-04T17:22:05+01:00 <warning>kernel: [ 3334.337590] fp_netfilter_pre_routing: 2 callbacks suppressed
2021-10-04T17:20:44+01:00 <warning>kernel: [ 3252.987786] fp_netfilter_pre_routing: 6 callbacks suppressed
2021-10-04T17:20:37+01:00 <warning>kernel: [ 3246.107457] fp_netfilter_pre_routing: 10 callbacks suppressed
2021-10-04T17:06:16+01:00 <notice>mwan3: Primary/Next Primary interface wan1, is UP
2021-10-04T17:06:06+01:00 <notice>mwan3track: Interface wan1 (eth2) is online
2021-10-04T17:04:06+01:00 <warning>kernel: [ 2255.253155] fp_netfilter_pre_routing: 2 callbacks suppressed
2021-10-04T17:00:32+01:00 <warning>kernel: [ 2041.520016] fp_netfilter_pre_routing: 2 callbacks suppressed
2021-10-04T16:59:11+01:00 <warning>kernel: [ 1960.355394] fp_netfilter_pre_routing: 2 callbacks suppressed
2021-10-04T16:56:11+01:00 <warning>kernel: [ 1780.236453] fp_netfilter_pre_routing: 2 callbacks suppressed
2021-10-04T16:53:06+01:00 <notice>mwan3: Primary/Next Primary interface wan2, is UP
2021-10-04T16:53:05+01:00 <notice>mwan3track: Interface wan1 (eth2) is offline
2021-10-04T16:52:40+01:00 <notice>mwan3: Primary/Next Primary interface wan1, is UP
2021-10-04T16:52:30+01:00 <notice>mwan3track: Interface wan1 (eth2) is online
2021-10-04T16:52:12+01:00 <notice>mwan3: Primary/Next Primary interface wan2, is UP
2021-10-04T16:52:10+01:00 <notice>mwan3track: Interface wan1 (eth2) is offline
2021-10-04T16:30:56+01:00 <notice>mwan3: Primary/Next Primary interface wan1, is UP
2021-10-04T16:30:42+01:00 <notice>mwan3track: Interface wan1 (eth2) is online
2021-10-04T16:30:31+01:00 <notice>system: device booted with active firmware version: 1.0.03.22
2021-10-04T16:30:31+01:00 <notice>system: argument:all
2021-10-04T16:30:31+01:00 <notice>system: ##Checking lanwancheck work around Here
2021-10-04T16:30:28+01:00 <notice>system: Boot pattern, progress percentage: 100%. Setting switch LED to NORMAL operation.
2021-10-04T16:30:23+01:00 <notice>mwan3: Primary/Next Primary interface wan2, is UP
2021-10-04T16:30:22+01:00 <warning>kernel: [ 231.598070] fp_netfilter_pre_routing: 14 callbacks suppressed
2021-10-04T16:30:17+01:00 <notice>mwan3track: Interface wan1 (eth2) is offline
2021-10-04T16:30:01+01:00 <notice>system: Boot pattern, progress percentage: 75-100%
2021-10-04T16:29:43+01:00 <notice>system: Boot pattern, progress percentage: 50-75%
2021-10-04T16:29:26+01:00 <warning>kernel: [ 175.311230] ubi0 warning: ubi_io_read: error -74 (ECC error) while reading 4090 bytes from PEB 501:77680, read only 4090 bytes, retry
2021-10-04T16:29:26+01:00 <error>kernel: [ 175.311094] ECC correction failed for page 0x00000000
2021-10-04T16:29:26+01:00 <error>kernel: [ 175.311090] ECC: uncorrectable error 2 !!!
2021-10-04T16:29:26+01:00 <error>kernel: [ 175.309996] ECC correction failed for page 0x00000000
2021-10-04T16:29:26+01:00 <error>kernel: [ 175.309982] ECC: uncorrectable error 2 !!!
2021-10-04T16:29:19+01:00 <notice>mwan3: Primary/Next Primary interface wan2, is UP
2021-10-04T16:29:05+01:00 <notice>system: argument:
2021-10-04T16:29:04+01:00 <notice>mwan3: Primary/Next Primary interface wan1, is UP
2021-10-04T16:29:03+01:00 <notice>system: #Checking lanwancheck work around Here
2021-10-04T16:27:37+01:00 <warning>kernel: [ 142.854709] fp_netfilter_pre_routing: 8 callbacks suppressed
2021-10-04T17:27:29+02:00 <alert>system: domain name= and hostname=router35FF42 configured
2021-10-04T17:27:27+02:00 <notice>netifd: Interface 'wan2' has link connectivity 
2021-10-04T17:27:26+02:00 <notice>netifd: Interface 'wan1' has link connectivity 
2021-10-04T17:27:24+02:00 <notice>netifd: Interface 'wan2' has link connectivity loss
2021-10-04T17:27:22+02:00 <notice>netifd: Interface 'wan1' has link connectivity loss
2021-10-04T17:27:22+02:00 <notice>netifd: Interface 'wan2' has link connectivity 
2021-10-04T17:27:22+02:00 <notice>netifd: Interface 'wan1' has link connectivity 
2021-10-04T17:27:22+02:00 <notice>netifd: Interface 'vlan1' has link connectivity 
2021-10-04T17:27:15+02:00 <notice>system: Boot pattern, progress percentage: 25-50%

Anyone an idea whats going on? Is it a configuration issue or something more severe?

Thanks,

Ed

marce1000 · ‎10-04-2021

>....

                          >...ECC correction failed for page 0x00000000
  This is very bad , it indicates hardware problems, have a power-off-on (restart), if it remains  the device needs to be
replaced. (RMA)

M.

-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

nagrajk1969 · ‎10-05-2021

Hi

as correctly adviced by @marce1000 , if after a power-cycle of the RV340,

a) you still see your internet connections on wan1 and wan2 fluctuating (and you see in the logs the interfaces going down/up - offline/online), then you should try with setting/configuring the "Network Service Detection" feature for wan1 and wan2 interfaces (under WAN/MultiWAN section of GUI) as shown in attached screenshot.

- Basically, instead of the default setting to "Default Gateway", set it to "Remote Host" 8.8.8.8 (which is Google-DNS-server which is expected to be always UP and reachable on internet)

- do it for both wan1 and wan2 interfaces, and then apply and also do a permanent-save AND then Reboot once

b) And after reboots/power-cycle (& applying the configuration as mentioned in point-a above), IF you still see the ECC-Memory errors, then as very correctly adviced by @marce1000 , you SHOULD get this router replaced

ed_grit · ‎10-05-2021

Thanks a lot for your comments. Your help is really appreciated! @nagrajk1969 @marce1000

During the night, WAN1 and WAN2 went offline and came back online several times. But I also got the following message:

2021-10-04T22:15:08+01:00 <warning>kernel: [20916.978912] FIREWALL SYN-FLOOD:IN=eth2 OUT= DST_MAC=04:eb:40:35:ff:40 SRC_MAC=:c8:0e:14:97:bd:d6 src=142.250.185.206 DST=192.168.177.2 LEN=72 TOS=0x00 PREC=0x00 TTL=60 ID=4638 PROTO=TCP SPT=443 DPT=58429 WINDOW=438 RES=0x00 ACK URGP=0 MARK=0xff00 
2021-10-04T22:15:08+01:00 <warning>kernel: [20916.978828] FIREWALL SYN-FLOOD:IN=eth2 OUT= DST_MAC=04:eb:40:35:ff:40 SRC_MAC=:c8:0e:14:97:bd:d6 src=142.250.185.206 DST=192.168.177.2 LEN=72 TOS=0x00 PREC=0x00 TTL=60 ID=4637 PROTO=TCP SPT=443 DPT=58429 WINDOW=438 RES=0x00 ACK URGP=0 MARK=0xff00 
2021-10-04T22:15:08+01:00 <warning>kernel: [20916.972434] FIREWALL SYN-FLOOD:IN=eth2 OUT= DST_MAC=04:eb:40:35:ff:40 SRC_MAC=:c8:0e:14:97:bd:d6 src=142.250.185.206 DST=192.168.177.2 LEN=302 TOS=0x00 PREC=0x00 TTL=60 ID=4632 PROTO=TCP SPT=443 DPT=58429 WINDOW=438 RES=0x00 ACK PSH URGP=0 MARK=0xff00 
2021-10-04T22:15:08+01:00 <warning>kernel: [20916.971438] FIREWALL SYN-FLOOD:IN=eth2 OUT= DST_MAC=04:eb:40:35:ff:40 SRC_MAC=:c8:0e:14:97:bd:d6 src=142.250.185.206 DST=192.168.177.2 LEN=428 TOS=0x00 PREC=0x00 TTL=60 ID=4631 PROTO=TCP SPT=443 DPT=58429 WINDOW=438 RES=0x00 ACK PSH URGP=0 MARK=0xff00 
2021-10-04T22:15:08+01:00 <warning>kernel: [20916.971353] FIREWALL SYN-FLOOD:IN=eth2 OUT= DST_MAC=04:eb:40:35:ff:40 SRC_MAC=:c8:0e:14:97:bd:d6 src=142.250.185.206 DST=192.168.177.2 LEN=446 TOS=0x00 PREC=0x00 TTL=60 ID=4630 PROTO=TCP SPT=443 DPT=58429 WINDOW=438 RES=0x00 ACK PSH URGP=0 MARK=0xff00

Could this even be a virus? Is it related to the WAN problem or a separate issue? Would be great to get your thoughts on this issue as well!

nagrajk1969 · ‎10-05-2021

No thats not a virus, but a Denial of Service (DDoS/DoS) attack "Syn-Flood" from the internet on your wan1 port

- But the firewall service has protection against this (hope the checkbox for DoS is enabled in the firewall service)

In this situation, becos of the flood-attacks happening, you should for time-being immediately disable/uncheck "Network Service Detection" in the WAN/MultiWAN (for both wan1 and wan2 interfaces)completely and apply-save and just once reboot

You see the "NSD" is used by the MultiWAN (controlling the dual-wan functionality in fail-over and load-balance modes) to send ping-keepalives at regular intervals to either the Default-Gw (default-settings) Or the Remote-Host and if the ping-replies dont get received for any number of reasons, the multiwan service makes the wan1/wan2 interface "offline" (meaning there is no further routing/forwarding of traffic done on that wan interface...although the link maybe active/up)....and when the ping-keepalives are working correctly then the wan1/wan2 interfaces are brought "Online"

- In case the wan links goes down too, then too the multiwan service will make the wan interface offline/down

So disable the NSD on both wan interfaces for now and appl-save-reboot once

ed_grit · ‎10-05-2021

Thanks @nagrajk1969 ! I have just unchecked the boxes. I will report in a few hours whether this has solved my problems! But thanks so far! Regarding the reboot: I did the reboot via the GUI - is this ok or shall I use the manual on/ off switch of the router to actually cut off the energy for a few seconds?

And do I need to be worried to be attacked as an individual by a DoS attack? Should I do anything against it or is it enough that the DoS protection is enabled in the firewall settings of my RV340W?

marce1000 · ‎10-05-2021

- Please note that if you keep getting these kind of messages :

ECC correction failed for page 0x00000000

and or any line(s) containing ECC ,. then the device should be replaced

M.

-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '