TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

AT&T updates firmware to block access to 1.1.1.1

999 点作者 antoinefink大约 7 年前

46 条评论

jaas大约 7 年前
I&#x27;d say there is a 98% chance this is a bug in some firmware and a 2% chance AT&amp;T is intentionally trying to block Cloudflare DNS.<p>I get why people are paranoid about ISPs blocking content and net neutrality, but let&#x27;s not cry wolf prematurely. The technical details here strongly suggest a bug rather than intentional blocking of 1.1.1.1 DNS traffic.
评论 #16982557 未加载
评论 #16982589 未加载
评论 #16982532 未加载
评论 #16982528 未加载
评论 #16982559 未加载
评论 #16985493 未加载
评论 #16982577 未加载
评论 #16985020 未加载
评论 #16984634 未加载
评论 #16982690 未加载
评论 #16996561 未加载
评论 #16983388 未加载
评论 #16982612 未加载
评论 #16982600 未加载
mabbo大约 7 年前
I wonder if anyone has considered some sort of legislation whereby internet service providers are not allowed to block or disrupt service to certain parts of the internet in order to promote their own business model.
评论 #16982153 未加载
评论 #16982560 未加载
评论 #16983858 未加载
评论 #16982122 未加载
评论 #16984620 未加载
评论 #16986233 未加载
评论 #16984627 未加载
评论 #16982168 未加载
评论 #16982189 未加载
AgentK20大约 7 年前
Cloudflare&#x27;s CEO confirms: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;eastdakota&#x2F;status&#x2F;991718955021623296" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;eastdakota&#x2F;status&#x2F;991718955021623296</a>
评论 #16982143 未加载
评论 #16982449 未加载
netsec_burn大约 7 年前
This isn&#x27;t malice. AT&amp;T has an internal IP they assigned to 1.1.1.1 because it was unused and they used it as an image caching proxy so it browsing the internet would feel faster on early phones. I&#x27;ve seen it when I was reverse engineering on Android a while back.
评论 #16990813 未加载
评论 #16987917 未加载
评论 #16985076 未加载
评论 #16985219 未加载
评论 #16985230 未加载
mstaoru大约 7 年前
Shanghai. One of the largest Chinese data-centers with direct peering to all major national networks. I&#x27;m inside, testing a new colocation unit we just put there. Pinging 1.1.1.1 in 4.2ms, wow! Putting it in resolv.conf. Nothing works. WTF? Turns out they route 1.1.1.1 across the whole DC to one of their internal services &quot;for engineers&#x27; convenience&quot;. Not gonna change. TIC.
xtf大约 7 年前
From <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;1.1.1.1#Criticism_and_problems" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;1.1.1.1#Criticism_and_problems</a> :<p>Technological websites noted that by using 1.1.1.1 as the IP address for their service, Cloudflare created problems with existing setups. While 1.1.1.1 was not a reserved IP address, it was and is used by many existing routers (mostly those sold by Cisco Systems) and companies for hosting login pages to private networks, exit pages or other purposes, rendering the use of 1.1.1.1 as a manually configured DNS server impossible on those systems. Additionally, 1.1.1.1 is blocked on many networks and by multiple ISPs because the simplicity of the address means that it was previously often used for testing purposes and not legitimate use. These previous uses has lead to a huge influx of &quot;garbage&quot; data to Cloudflare&#x27;s servers.
评论 #16985043 未加载
评论 #16984729 未加载
评论 #16987510 未加载
techjuice大约 7 年前
I always thought it was strange to see the example loopback address listed as 1.1.1.1 or 1.xxx.xxx.xxx in many of tutorials and official network certification guides and why they did not use a private. This is more than likely why many users are having problems because they are being routed to a loopback address on their router or another router. Hopefully network admins and engineers will choose a non public ip space as their loopback address to resolve the problem.
评论 #16982230 未加载
评论 #16982134 未加载
评论 #16982251 未加载
评论 #16981684 未加载
评论 #16982719 未加载
fastball大约 7 年前
That&#x27;s so crazy, I actually experienced this today.<p>I&#x27;ve been using 1.1.1.1, and today went to the library for a quick work break. I pulled out my laptop and tried to connect to the wifi, and it wasn&#x27;t working. After a few minutes of troubleshooting, I tried deleting my custom DNS entry in my network settings and that did the trick.<p>I guess the library uses AT&amp;T routers.
评论 #16982477 未加载
bvinc大约 7 年前
How are they going to spy on your DNS traffic and sell it to advertisers after you secure it?
评论 #16981576 未加载
chrissnell大约 7 年前
Some folks use a Ubiquiti EdgeRouter and a user-space proxy to forward EAP (authentication) packets to the AT&amp;T router but otherwise use the EdgeRouter to route LAN traffic out to the ONT (fiber to Ethernet translator) and the internet, thus bypassing the shitty AT&amp;T router for most stuff. This would be sufficient to ensure that 1.1.1.1 is reachable.<p>It&#x27;s not a good solution for me, however, because I run PFSense, which is FreeBSD-based and lacks the PF_RING socket support to filter out those EAP packets. As far as I know, PFSense&#x27;s PF packet filter cannot strain them out, either. Traditional libpcap is available on FreeBSD (slow) and netmap (fast), too. I looked into writing an EAP proxy in Go using a special netmap-enabled libpcap but it was way too much yak shaving and I eventually gave up. I should take another look, or maybe learn enough C to do it natively with netmap. My goal is native EAP proxy support for PFSense that can support filtering EAP out of a wirespeed gigabit fiber connection.
tuna-piano大约 7 年前
Here is the original Cloudflare post on what 1.1.1.1 is [1]. For those who don&#x27;t know, 1.1.1.1 is Cloudflare&#x27;s privacy focused DNS service. That means that when you type in www.google.com, that URL can be sent to 1.1.1.1, and then 1.1.1.1 resolves that URL an IP address and send the IP back to the user. All user requests are then sent to the IP address, not the URL. Supposedly this is better than using the DNS server of ATT+Comcast, because ATT+Comcast want your browsing history while Cloudflare does not.<p>What I don&#x27;t understand is how this really helps user privacy much. If AT&amp;T, Comcast, etc want to know your browsing habits, can&#x27;t they still see the IP addresses you&#x27;re browsing and figure out the URL from the IPs? I can&#x27;t see that as too big an impediment, but maybe someone with more knowledge can share.<p>[1] <a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;announcing-1111&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;announcing-1111&#x2F;</a>
评论 #16982907 未加载
评论 #16982905 未加载
js2大约 7 年前
This is likely due to incompetence, not malice.<p>FWIW, it’s possible to bypass AT&amp;T’s router:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;jaysoffian&#x2F;eap_proxy" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;jaysoffian&#x2F;eap_proxy</a><p>That said, I tried 1.1.1.1 and found I had to switch back to Google DNS since Cloudflare intentionally doesn’t support EDNS Client Subnet which was causing my AppleTV’s to have trouble loading content.
评论 #16982625 未加载
评论 #16982661 未加载
评论 #16982917 未加载
评论 #16983026 未加载
sxates大约 7 年前
Does this just apply to setting the default DNS on the router, or are the blocking traffic to 1.1.1.1 from any device connected to it?
评论 #16982304 未加载
评论 #16982236 未加载
kev009大约 7 年前
Knowing how bad most telco networks are operated, I blithely wonder if maybe they were using stuff in 1.&#x2F;8 as PNI or some other privileged internal net and are going through some oh shit moments.<p>Hanlon&#x27;s razor as lots of DNS services are available on not as vanity IP space, and there is no evidence of blockage.
sitepodmatt大约 7 年前
It shocks me that there are no AT&amp;T network&#x2F;sysadmins at the right level and department on this forum that don&#x27;t cringe in shame and sort this out.
评论 #16984988 未加载
pedrosanta大约 7 年前
I would cancel any broadband contract of any ISP that did this when providing me a service. We need to stand up to these sort of things. (Disclaimer: I live in Europe though.)
评论 #16986089 未加载
jedberg大约 7 年前
My guess is this is just incompetence and not intentionally made to block CloudFlare.<p>I have one of those routers, and I couldn&#x27;t use 1.1.1.1 because it was routing to an internal interface on the router. I confirmed this with ping, I was getting microsecond response times from 1.1.1.1.<p>Under the new firmware, 1.1.1.1 is just dead. So it&#x27;s probably still connected to the local interface, and nothing is listening.
评论 #16982497 未加载
PinkMilkshake大约 7 年前
This is going to reveal my lack of networking knowledge but how does a company get an IP like 1.1.1.1? A bucket load of cash?
评论 #16983281 未加载
评论 #16984880 未加载
taf2大约 7 年前
I’m on at&amp;t lte and this is working just fine... is this a broad band provider thing?
评论 #16983238 未加载
评论 #16982349 未加载
Abishek_Muthian大约 7 年前
Anyone else facing such issues with their ISP for 1.1.1.1 ?<p>Cloudflare DNS seems to be down for couple of major ISP&#x27;s in India as well according to CF forums -<p>[ACT] <a href="https:&#x2F;&#x2F;community.cloudflare.com&#x2F;t&#x2F;cloudfare-dns-blocked-with-act-isp-in-india&#x2F;16916&#x2F;10" rel="nofollow">https:&#x2F;&#x2F;community.cloudflare.com&#x2F;t&#x2F;cloudfare-dns-blocked-wit...</a><p>[Airtel] <a href="https:&#x2F;&#x2F;community.cloudflare.com&#x2F;t&#x2F;cloudflare-dns-not-working-in-india-isp-airtel-may-have-blocked-it&#x2F;16419" rel="nofollow">https:&#x2F;&#x2F;community.cloudflare.com&#x2F;t&#x2F;cloudflare-dns-not-workin...</a>
评论 #16986679 未加载
thetwentyone大约 7 年前
FWIW as an ATT Fiber customer, I was not able to (and am still not able to) access 1.1.1.1. I tried just a couple days after Cloudflare announced the service, and requests timed out. I can access with a VPN, however.
johnvega大约 7 年前
If at&amp;t does not provide any official explanation, what&#x27;s your opinion on how people should respond. The first thing that came to mind for me is to switch over to Xfinity on my next contract cycle.
评论 #16983596 未加载
评论 #16982753 未加载
评论 #16982679 未加载
cottsak大约 7 年前
More solid advice regarding home internet&#x2F;ISP routers: <a href="https:&#x2F;&#x2F;www.tomsguide.com&#x2F;us&#x2F;home-router-security,news-19245.html" rel="nofollow">https:&#x2F;&#x2F;www.tomsguide.com&#x2F;us&#x2F;home-router-security,news-19245...</a><p>Try to avoid the cheap bundled cable&#x2F;fibre&#x2F;DSL routers that ISPs &quot;throw in&quot; with their plans&#x2F;packages.<p>Disable the remote management&#x2F;update&#x2F;TR-069&#x2F;CWMP&#x2F;SSH&#x2F;etc if you can. You don&#x27;t wanna trust someone else to secure your home.
walrus01大约 7 年前
There are an astonishing number of corporate end users also using &quot;unused&quot; chunks &#x2F;8 sized of IP space internally. As if rfc1918 wasn&#x27;t big enough.
cottsak大约 7 年前
How is the ISP performing this remote update? Is it TR-069&#x2F;CWMP or an open SSH port or something? Many routers will allow the user to disable TR-069 even while it&#x27;s running. Often a hardware reset will also disable it and then the user can put the manufactures update on it and prevent the ISP from managing it in the future. If it&#x27;s an open SSH port then we all have bigger problems.
评论 #16996945 未加载
cottsak大约 7 年前
This problem has been around for a while and is pretty serious! <a href="https:&#x2F;&#x2F;www.routersecurity.org&#x2F;ISProuters.php" rel="nofollow">https:&#x2F;&#x2F;www.routersecurity.org&#x2F;ISProuters.php</a>
jacksmith21006大约 7 年前
Is there anyone before Google that went after getting one of these marketing IPs?<p>First time I saw it was 8.8.8.8.<p>I personally had one had in my head from the 80s 128.252.120.1. bit it is obviously not a special one.
arriu大约 7 年前
While far from perfect, for anyone looking for a temporary solution, run pi-hole on a remote server and have it use 1.1.1.1 as its DNS. You&#x27;ll get the benefit of pi-hole blocking ads.
hamandcheese大约 7 年前
I really wish Cloudflare would have used a &quot;normal&quot; IP for their DNS service. That way there would be no confusion whatsoever as to whether this is malicious or a bug.
评论 #16983760 未加载
aosmith大约 7 年前
Is there any reason you couldn&#x27;t just tunnel &#x2F; proxy your DNS? I know that isn&#x27;t an option for most people but I think that would solve the problem.
m-p-3大约 7 年前
I&#x27;m wondering what CloudFlare response will be to this.
aosmith大约 7 年前
Is this only DSL? I have ATT fiber, no problems here.
评论 #16983565 未加载
评论 #16983085 未加载
okket大约 7 年前
Sure this is intentional? The headline suggests so, otherwise<p>&quot;AT&amp;T firmware update blocks access to 1.1.1.1&quot;<p>would be more accurate IMHO.
justinzollars大约 7 年前
I&#x27;m going to ask for a partial refund every month if they are blocking parts of the internet.
评论 #16985602 未加载
评论 #16984897 未加载
_bxg1大约 7 年前
Jesus Christ. Fortunately I only have AT&amp;T on mobile and it still works there, but I will ditch them in a heartbeat if that changes. At least in the cellular space there&#x27;s still some consumer choice to be had.
akshatkedia大约 7 年前
1.1.1.1 blocked in India too on BSNL connections.
intrasight大约 7 年前
As a consumer, you are free to switch to a different provider. I&#x27;m not saying what they&#x27;re doing is ok, but let&#x27;s not neglect the opportunity to vote with our $$$.
评论 #16982507 未加载
评论 #16982521 未加载
评论 #16982699 未加载
cabaalis大约 7 年前
What is the likelihood of obtaining net neutrality through the courts? I.E. Cloudflare sues -&gt; judicial process -&gt; decision that establishes a &quot;right to access&quot;?
评论 #16982264 未加载
评论 #16982603 未加载
JumpCrisscross大约 7 年前
What about AT&amp;T&#x27;s wireless network?
cyanbane大约 7 年前
Do they block quad9? Although I trust AT&amp;T about as far as I can throw them, this may just be a bad config&#x2F;update.
ryan-c大约 7 年前
Late to the party, but here&#x27;s some traceroutes run from AT&amp;T Gigapower with their router <i>entirely</i> bypassed via an 802.1x MitM:<p><pre><code> # traceroute 1.0.0.1 traceroute to 1.0.0.1 (1.0.0.1), 30 hops max, 60 byte packets 1 45-18-124-1.lightspeed.austtx.sbcglobal.net (45.18.124.1) 59.462 ms 61.348 ms 63.373 ms 2 71.149.77.208 (71.149.77.208) 1.304 ms 1.695 ms 1.957 ms 3 75.8.128.136 (75.8.128.136) 1.329 ms 1.682 ms 1.393 ms 4 12.83.68.145 (12.83.68.145) 2.673 ms 2.661 ms 2.648 ms 5 12.123.18.233 (12.123.18.233) 8.877 ms 12.753 ms 8.800 ms 6 192.205.36.206 (192.205.36.206) 6.663 ms 6.375 ms 6.680 ms 7 66.110.56.158 (66.110.56.158) 6.885 ms 6.725 ms 6.436 ms 8 1dot1dot1dot1.cloudflare-dns.com (1.0.0.1) 6.855 ms 6.557 ms 6.662 ms # traceroute 1.1.1.1 traceroute to 1.1.1.1 (1.1.1.1), 30 hops max, 60 byte packets 1 45-18-124-1.lightspeed.austtx.sbcglobal.net (45.18.124.1) 163.322 ms 163.927 ms 174.243 ms 2 71.149.77.208 (71.149.77.208) 1.346 ms 1.779 ms 2.035 ms 3 75.8.128.136 (75.8.128.136) 1.215 ms 1.214 ms 1.564 ms 4 12.83.68.137 (12.83.68.137) 1.495 ms 12.83.68.145 (12.83.68.145) 2.289 ms 12.83.68.137 (12.83.68.137) 2.283 ms 5 12.123.18.233 (12.123.18.233) 7.783 ms 11.766 ms 11.757 ms 6 192.205.36.206 (192.205.36.206) 6.163 ms 6.160 ms 6.202 ms 7 66.110.56.158 (66.110.56.158) 6.909 ms 6.931 ms 6.423 ms 8 1dot1dot1dot1.cloudflare-dns.com (1.1.1.1) 6.922 ms 6.492 ms 7.075 ms ; &lt;&lt;&gt;&gt; DiG 9.9.5-9+deb8u14-Debian &lt;&lt;&gt;&gt; cloudflare.com @1.1.1.1 ;; global options: +cmd ;; Got answer: ;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, status: NOERROR, id: 15100 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1536 ;; QUESTION SECTION: ;cloudflare.com. IN A ;; ANSWER SECTION: cloudflare.com. 53 IN A 198.41.214.162 cloudflare.com. 53 IN A 198.41.215.162 ;; Query time: 7 msec ;; SERVER: 1.1.1.1#53(1.1.1.1) ;; WHEN: Thu May 03 13:40:52 UTC 2018 ;; MSG SIZE rcvd: 75 ; &lt;&lt;&gt;&gt; DiG 9.9.5-9+deb8u14-Debian &lt;&lt;&gt;&gt; cloudflare.com @1.0.0.1 ;; global options: +cmd ;; Got answer: ;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, status: NOERROR, id: 61685 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1536 ;; QUESTION SECTION: ;cloudflare.com. IN A ;; ANSWER SECTION: cloudflare.com. 66 IN A 198.41.214.162 cloudflare.com. 66 IN A 198.41.215.162 ;; Query time: 7 msec ;; SERVER: 1.0.0.1#53(1.0.0.1) ;; WHEN: Thu May 03 13:40:39 UTC 2018 ;; MSG SIZE rcvd: 75 </code></pre> I&#x27;m not going to paste the output, but `curl <a href="https:&#x2F;&#x2F;1.1.1.1&#x2F;`" rel="nofollow">https:&#x2F;&#x2F;1.1.1.1&#x2F;`</a> works as well.<p>Doesn&#x27;t look like it&#x27;s anything onn AT&amp;T&#x27;s internal network.
评论 #16987316 未加载
waldbeere大约 7 年前
hong-kong airport free Wifi 1.1.1.1 not works with this DNS
exabrial大约 7 年前
File FCC complaints! This sorry if thing will definitely get a response.
评论 #16982618 未加载
mdip大约 7 年前
I&#x27;ll go on record as saying I am an ardent <i>hater</i> of U-Verse and AT&amp;T due to personal experience with their service and would like nothing more than for this to be a purposeful act that would result in backlash on that company...<p>... that said, I&#x27;m going to fall in the camp of stating that this is likely an unintentional bug. If they truly wanted to block 1.1.1.1 (and it&#x27;s backup), doing so via firmware would seem to be the most difficult and unreliable way of doing so. The benefits of doing so are also limited: (a) If the motivation was to avoid losing the ability to spy on their customers via DNS requests, well ... they can still do that. Yes, Cloudflare supports encrypted DNS, but the half of one percent of folks who have this set up wouldn&#x27;t be worth the effort[0]. (b) If there was some <i>other</i> reason to want customers using their DNS (i.e. redirection to advertising pages when lookup fails), they could simply do packet rewrites (of non-encrypted DNS lookups) to send them over to AT&amp;Ts infrastructure -- the benefit of doing this is that it would be more likely to go unnoticed[1]. (c) There have been several <i>other</i>, far more popular and just as well publicized public DNS services that they haven&#x27;t messed with -- why pick on a new entrant -- why not break 8.8.8.8 or OpenDNS?<p>More likely is the explanation that 1.1.1.1 was being used as a defact-o 10.x.x.x address for other purposes. It had a few benefits -- it was far less likely to be used as an internal address for customers (being ... <i>not</i> a traditional non-routable address) and up until recently, it was unlikely to be used for legitimate services. Or ... it&#x27;s something else. Firmware bugs are <i>everywhere</i> and having had their service and the particular brand of modem they&#x27;re using, I&#x27;m not the least bit surprised. I had to root my modem to make my service work reliably[2]. Heck, I worked for a telecom for 17 years, and the first half of that, the guy who set our network up used 1-10.x.x.x as internal addresses.<p>[0] It&#x27;s not terribly difficult to do, but few take the effort. I&#x27;ve got an internal DNS server configured (for AD purposes) which forwards to another internal DNS server that makes all DNS requests out to cloudflare via encrypted DNS. It was a 5 minute change to my internal setup, a lot of which was the time it took to download the container, reboot the host for testing purposes and validation of everything.<p>[1] It probably would have managed to be hidden an entire <i>minute</i> longer than this debacle.<p>[2] On their DSL (re-labeled U-Verse despite it having nothing to do with their U-Verse TV&#x2F;Internet -- it&#x27;s the <i>old</i> DSL limited to 12Mb down <i>if you&#x27;re lucky</i>), my modem would randomly display the &quot;Internet is down&quot; page for all requests despite everything being fine. I forgot, exactly, what I had to do to resolve it, but it required hitting their ping page to trigger a buffer overflow, allowing me to get console access and running some command. I also wanted to be able to ping the modem remotely (something they disable with no customer-facing option to correct) to correlate it with weather so as to prove to customer service (...and at least a little to myself) that this bizarre happenstance wasn&#x27;t all in my head. My next-door neighbors also had this problem, so I suspected it was something in the wiring (expansion&#x2F;contraction-like) up the street, but it was hard to track down <i>where</i> because all but two people on that street (including us) used those homes as summer vacation homes and were rarely there in the winter -- many didn&#x27;t have service and those who did were unlikely to be around when the weather hit about 40 degrees, so AT&amp;T wasn&#x27;t getting reports of outages in enough frequency to do anything about it. Two years ago, they sent a truck, took everyone down and re-did a pole 8 houses down. Since then, the problem hasn&#x27;t happened.
exabrial大约 7 年前
My parent company uses 1.1.1.1 as a captive portal address on the guest network. Easy to remember, but cloudflare probably needs to stand up some more conventional DNS ips.
评论 #16984448 未加载
评论 #16983144 未加载
dingo_bat大约 7 年前
Good. If cloud fare is allowed to block sites from their hosting service based on opinions, then att should be allowed to do the same. Also fuck cloud fare for choosing 1.1.1.1 when any network engineer worth his salt would have told them it&#x27;s going to cause problems. There are things like conventions and traditions, you break them at your own peril.
评论 #16985520 未加载