10 ms·
I'd say there is a 98% chance this is a bug in some firmware and a 2% chance AT&T is intentionally trying to block Cloudflare DNS. I get why people are paranoi
by jaas 8y ago
I'd say there is a 98% chance this is a bug in some firmware and a 2% chance AT&T is intentionally trying to block Cloudflare DNS.
I get why people are paranoid about ISPs blocking content and net neutrality, but let's not cry wolf prematurely. The technical details here strongly suggest a bug rather than intentional blocking of 1.1.1.1 DNS traffic.
- droopybuns 8y agoCan someone link to the firmware? It shouldn't be hard to binwalk this and figure out wtf is happening. Also- If this was intentional- I'm betting they'd filter it for the mobile network as well. This has got to be a fuck-up.
- bbayles 8y agoYou're absolutely right about this. This is almost certainly just there to block people who mistakenly paste in an example configuration somewhere. Back in 2010 there were problems that came up when IANA started allocating out of 1.0.0.0/8 (e.g. [1]). Things that were once assumed to be unused started being used, leading to strange issues. Also, why on earth would AT&T block 1.1.1.1 and not Google DNS and OpenDNS? [1] https://bgpmon.net/issues-with-allocating-from-1-0-0-08/ https://bgpmon.net/issues-with-allocating-from-1-0-0-08/
- vvanders 8y agoAccording to the thread the timing on this looks pretty bad since those DNS IPs were previously working on the earlier firmware.
- adventured 8y agoHow would it make sense to block it only on a small fraction of their entire network? It wouldn't accomplish anything.
- chillingeffect 8y agowhen 1.1.1.1 was first announced a few weeks ago, many people pointed out at the time that it was already blocked because so many people had effectively polluted it by over-using it for demo examples and testing traffic. CF announced they knew this and intended to do a project analyzing the data. Perhaps this done, whether conveniently or not, with the same intention. We'll see if they reverse it.
- jjeaff 8y agoThen the odds appear to not be in our favor. CF CEO tweets that 1.0.0.1 is also blocked. https://twitter.com/eastdakota/status/991718955021623296 https://twitter.com/eastdakota/status/991718955021623296 Others have confirmed that the ipv6 address belonging to CF appears to be blocked.
- _bxg1 8y agoDo you have a reference for the ipv6 address being blocked? That would be a much bigger smoking gun
- Zren 8y agohttps://blog.cloudflare.com/dns-resolver-1-1-1-1/ https://blog.cloudflare.com/dns-resolver-1-1-1-1/ > For IPv6, we have chosen 2606:4700:4700::1111 and 2606:4700:4700::1001 for our service. It’s not as easy to get cool IPv6 addresses; however, we’ve picked an address that only uses digits. For me up in Canada, ping 1.1.1.1 works. But ping6 2606:4700:4700::1111 ping6 2606:4700:4700::1001 shows "connect: Network is unreachable". Am I using ping6 wrong? We also need to confirm IPV6 works outside AT&T's network. Edit: Just tried Google's DNS. 8.8.8.8 works, but their IPv6 doesn't, so I guess this was a bad test. Edit2: Learned about nslookup, but it does not seem to work with either Google or CloudFlare's DNS. nslookup reddit.com # Works nslookup reddit.com 1.1.1.1 # Works nslookup reddit.com 1.0.0.1 # Works nslookup reddit.com 2606:4700:4700::1111 # Does not nslookup reddit.com 8.8.8.8 # Works nslookup reddit.com 2001:4860:4860::8888 # Does not nslookup reddit.com 2001:4860:4860:0:0:0:0:8888 # Does not Edit3: Apparently my ISP doesn't support IPv6 yet.
- blinkingled 8y agoYou're using the IPV6 address correctly, does https://test-ipv6.com https://test-ipv6.com report everything's dandy for you? If it does maybe they're blocking traffic or there's something else going on.
- 8y ago
- sjwright 8y agoHaving it seem like a bug would be an effective way to block it intentionally. The timing of such an unusual regression is suspicious. The fact that 1.0.0.1 is also blocked is also suspicious.
- mortenjorck 8y agoA conspiratorial Hanlon's corollary: The most effective malice is that which can be ascribed to incompetence.
- brownbat 8y ago> Having it seem like a bug would be an effective way to block it intentionally. Just like how only the true messiah denies his divinity, it doesn't give innocent bugs much of a chance. In fact, now we can show that all bugs are suspicious, with apologies to the interesting number paradox: The least intentional looking bug is the most effectively hidden, and therefore should probably be suspected of being intentional. Since it's now suspect, it's longer the least intentional looking bug, so the next least suspicious bug suddenly deserves a bit more scrutiny, and so on.
- sjwright 8y agoThat's not my point. It's suspicious because of its specificity and timing; its bug-like presentation isn't evidence either way.
- fiddlerwoaroof 8y agoA university I went to used 1.1.1.1 for its WiFi loginpage
- samstave 8y agoI thiught thats what early cisco (after they bought air-something) used c. 2005 or so
- mischov 8y ago1.1.1.1 was working for me on AT&T after Cloudflare released 1.1.1.1, then shortly after that it ceased working. Maybe the firmware update has a bug, but it's very suspiciously timed. Notice that the OP is dated April 2, while 1.1.1.1 was released April 1.
- c0nducktr 8y agoThis is what happened to me as well. It worked for a day or so and then stopped. I have ATT U-verse internet service and use their Arris BGW210-700 gateway One interesting thing is that if I go to the gateway management page, and use their diagnostic tools, I'm able to ping / traceroute the address - but I can't from any devices connected to the gateway From gateway diag page: PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=64 time=0.568 ms 64 bytes from 1.1.1.1: seq=1 ttl=64 time=0.156 ms 64 bytes from 1.1.1.1: seq=2 ttl=64 time=0.164 ms 64 bytes from 1.1.1.1: seq=3 ttl=64 time=0.144 ms --- 1.1.1.1 ping statistics --- 4 packets transmitted, 4 packets received, 0% packet loss round-trip min/avg/max = 0.144/0.258/0.568 ms traceroute to 1.1.1.1 (1.1.1.1), 30 hops max, 38 byte packets 1 1dot1dot1dot1.cloudflare-dns.com (1.1.1.1) 0.285 ms 0.177 ms 0.090 ms The times on the pings make it look like its hitting a loopback address instead. Pings to 8.8.8.8 from the diagnostics page take about 23 ms. No way 1.1.1.1 is completing in under 1ms haha
- jlgaddis 8y agoYes, 1.1.1.1 is in use on your Arris device, the same issue with the 5268AC since day one.
- bratsche 8y agoI was using 1.1.1.1 with AT&T Fiber and it stopped working. I didn't really question it, I figured maybe something went down at Cloudflare so I just switched my Mac back to using the defaults again. It never even occurred to me that AT&T might be blocking it. Maybe stupid question, but why would AT&T block it?
- lavezzi 8y ago
- trumped 8y agoYou could swap out those two odds and you would be just as right...
- InitialLastName 8y agoThey could swap those odds with anything but 100% to 0% and they would still be just as "right" once the answer comes out.
- trumped 8y agoexactly... why pull out random numbers out of your ass?
- djsumdog 8y agoWhat's that saying about not attributing to malice, what is more easily explained as stupidity or incompetence or whatever? (Occom's Razon and all that). AT&T routers also don't let you use a 10.x address at home (possibly to prepare for carrier grade NAT, although there is an official 100.x address reserved for that; so fuck you ATT). I'm so sick of my AT&T router/modem for various other reasons. I hate how you are required to use it for many of their offerings (including Fiber to the home). There are a number of tools out there for putting their router behind your Linux box. Most of them configure ebtables or use scripts to forward the 802.1q authentication packets to/from the router.
- lost_vegetable 8y ago> What's that saying about not attributing to malice, what is more easily explained as stupidity or incompetence or whatever? Hanlon's razor: https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor
- deleted 8y ago[deleted]
- craftkiller 8y agoWouldn't it be possible to use your own router and treat the AT&T router essentially like a modem? I ask because I'm about to move to an address that can get AT&T fiber.
- ynniv 8y agoYes: https://www.att.com/Common/storefront/resources/pdf/att_bridged_mode_vs_ip_passthrough_nov2012_v3.pdf https://www.att.com/Common/storefront/resources/pdf/att_brid... However, I still can't ping 1.1.1.1.
- djsumdog 8y agoSort-of. It has a DMZPlus mode, but all it does is assign the public IP to an specific internal device and uses NAT, as well as forwarding all ports, to make it look like that device is onthe public Internet (even though the modem has the same public IP). You can still plug in other devices and they get private IPv4s or parts of your IPv6 prefix and it NATs (the IPv4) those as well (it's to support their VoIP phones and TV service). It's a shitty hack and it adds a weird layer of indirection that's kinda buggy and doesn't always flow traffic the way you think it's being flowed. The IPv6 stuff gets confusing as well because the modem is still dishing out public IPv6 address, so if you want to advertise them as well, you've got to start slicing up your prefix.
- sterlind 8y agoAnyone work at AT&T who could give us the inside scoop on these firmware changes? Snapping a photo of the blocking code would be a valuable public service. Remember to scrub EXIF data!
- ocdtrekkie 8y agoMore than likely: - If the action was malicious, the people involved in writing this code are likely okay with it and not likely to leak details of it. - If the issue is a bug, the people involved in writing this code are probably working to fix it, and not likely to leak details of it. - People not involved with making it would likely leave an internal access trail (independent of EXIF data) when they access that code. Which is to say, expecting an Ed Snowden every time a company does something unethical is kinda silly, otherwise we'd have Google's search algorithm by now.
- sterlind 8y ago1. Probably. 2. True. 3. Unlikely; it's likely in a big repo that's synched all at once. Alternatively, we can just obtain the firmware from a device and diff it against the last-known-working version, to see how the routing is failing.
- aosmith 8y agoI really hope that's the case, was 1.1.1.1 allocated before CF acquired it? Was 1.0.0.1 also blocked?
- j16sdiz 8y ago1.1.1.0/24 was reserved by APNIC for research use. Lots of cisco example config use 1.1.1.1 for router internal identifier / DHCP server / OSPF dummy network . Not suprised if it break anything.
- csomar 8y agoBlocking 1.1.1.1 -> 98% chance it is a bug Blocking 1.1.1.1 and 1.0.0.1 -> what are the odds here?
- qrbLPHiKpiux 8y agoOnly one may be coincidental. Two is enemy action.
- solotronics 8y agoeverything from 1.0.0.0/8 to 1.0.0.0/15 would encompass those IPs so who knows what but my guess would be some routing or other strange internal usage of some of those subnets
- cup-of-tea 8y agoIt's either malicious or a major fuck up. Either way it's worth shouting about.
- danesparza 8y agoIt's the latter. Here is the CEO of Cloudflare tweeting about it: https://twitter.com/eastdakota/status/991718955021623296 https://twitter.com/eastdakota/status/991718955021623296 D
- nkozyra 8y agoWhere do you see that this was a mistake? That tweet thread doesn't have anything definitive on it.
- stickdogg 8y agoThis is an unrelated yet related question. I am trying to access apple support, I use at&t. When I go to support.apple.com I get an error message stating : Access Denied. You do not have permission to access "http://support.apple.com" http://support.apple.com" on this server. And gives me a long reference hash. This is at&t denying me access?
- some_account 8y agoMy router stopped working a few weeks after using 1.1.1.1. Weird things are happening with it.