Disabling DHCP causes DNS issues

[leenowell]

Hi All,

I am having issues with sporadic massive ping times so because I had an old Brightbox router, EE sent me a new Brightbox 1 hoping it will fix the problem.

On the new router, if I disable DHCP I can ping an external IP address fine (e.g. 8.8.8.8) but get name resolution errors when I ping by name (e.g. www.bbc.co.uk ).  Doing nothing else other than switching DHCP back on resolves the issue.  DNS is set to "get from ISP" but have also tried manually putting in Google's DNS servers and EE's DNS servers and it still doesn;t work.

The interface of the old and new router is the same but the old one works as expected and the new one has this DNS issue.

Only other thing to add is that when I got the router the wireless light was off (and I couldn't see the SSID) however the EE call centre person remotely connected to the router and it said it was on.  A factory reset solved the problem.  Also, when I change settings, sometimes it seems to kill the webserver on the router as I can no longer connect to the admin site.  Rebooting the router seems to fix it.  I wonder if somehow the firmware is messed up on the router they shipped me?

Any help appreciated.

Thanks

Lee.

[XRaySpeX]

@mikeliuk : How to find a router's internal ports from Win? 

[mikeliuk]

Apparently nmap also exists for Windows.

https://nmap.org/book/inst-windows.html

Cygwin is another option. People looking for some fun can run Linux under Windows 10.

When I recover from gardening, I may search for the native Windows 10 method if no one beats me to that first. 🤓

[pip11]

I'm enjoying the popcorn with this thread. Hope you two carry on.

[XRaySpeX]

@leenowell : You haven't yet said which models of Brightbox your old & new routers are.

[XRaySpeX]

Thanks, @pip11 , but I'm after a native Win facility. I'm not inclined to d/load yet another utility to follow up a line of enquiry that I believe leads nowhere beyond what we already knew at almost the start of this thread. How does knowing whether a particular router port is open or closed tell us any more than knowing that with the router's DHCP disabled a DNS lookup from a PC always fails? We are not the router's maintenance team, any more than EE is. It is for them to find the underlying & root causes, if indeed there is 1. I still have my doubts.

[mikeliuk]

Apparently at one point "tnc <router_internal_ip> -port 53" would do it.

https://www.itechtics.com/check-open-network-port/

May have changed to newer PowerShell method.

https://docs.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver201...

[XRaySpeX]

@mikeliuk Thanks. Generally I never go anywhere w/out Telnet but that pointer to PS tnc looks useful.

I have looked at a variety of metrics which seem to be interesting & relevant and compared them on a Brightbox 2 with its DHCP ON & OFF: 

Metric	DHCP Enabled	DHCP Disabled
PC IP	192.168.1.?	192.168.1.?
PC DNS	192.168.1.1	192.168.1.1
ping bbc.co.uk	Responds OK	Can't find Host
nslookup bbc.co.uk	Server: Brightbox -> IPs	Server: Unknown
Telnet port 53	Connecting to ...	Connect Fails
tnc -port 53	Success	Fail

I must admit that initially I thought that this difference was to be expected & did not tell us anything new. I put it down to my idea earlier that a DHCP-less router could not know or see the IP of the PC & so, even tho' it resolved the domain successfully, it could not get it back to the PC & then the PC in the absence of any reply from the router failed the operation. But I was wrong!

Here comes the interesting bit ...

I dug out an old ADSL Brightbox 1 which I thought was bricked cuz I had forgotten the Gateway IP I had assigned it so I could run it simultaneously with the Brightbox 2. Once I remembered & got into it I ran the above metrics on it.

Surprise, surprise! With or w/out the DHCP enabled the Brightbox 1 performed correctly exactly like the DHCP-enabled Brightbox 2.As you surmised & pin-pointed its port 53 was open whether or not its DHCP was enabled.

Therefore:

1. This issue does not occur with the old Brightbox 1. I presume the OP's old router was 1 of these (He has not confirmed this; @leenowell please would you do so?).
2. This issue does only occurs with the newer Brightbox 2 & probably with the contemporaneous Brightbox 1R. I presume the OP's new router was 1 of the latter (He has not confirmed this; @leenowell please would you do so?).

[leenowell]

Hi @XRaySpeX  @mikeliuk Sorry missed your messages as I didn't get an email notifying me.  Wonder if it is because I marked the thread as solved?

Anyway in response to your questions/ comments.

Just to be sure, my new router is one of these

https://shop.ee.co.uk/broadband/ee-bright-box-router

and the old one is one of these

https://www.bbc.co.uk/news/technology-25809208

Looks like we have a second confirmation of the issue as @XRaySpeX seems to have reproduced it on the same 2 routers.  It is worth comparing the firmware versions on my non-working Brightbox 1 and your Brightbox 2?  Mine says

Runtime Code Version v0.03.00.0001-OT (Fri May 22 15:28:11 2020)
Boot Code Version v0.00.05.0000-OT (Mon Mar 2 17:22:31 2015)
DSL Modem Code Version A2pG039o1.d24m
Hardware Version 01A

Thanks once again both and apologies again for the delay.

Lee.

[mikeliuk]

Given the choice, I would take the router with DHCP and DNS inexplicably coupled over the router with the remote exploit vulnerability! 😂

My contribution to this thread for today is the existence of the below example command taken directly from a RHEL article so the IPs are not personal data. The below example shows a rogue DHCP server is discovered but useful to this thread is that you see a DNS as part of the response.

$ sudo nmap --script broadcast-dhcp-discover -e bond0
Starting Nmap 7.70 ( https://nmap.org ) at 2020-10-28 19:24 CDT
Pre-scan script results:
| dhcp:
| Response 1 of 2:
| Interface: bond0
| IP Offered: 10.1.0.78
| DHCP Message Type: DHCPOFFER
| Server Identifier: 10.1.0.1
| IP Address Lease Time: 5m00s
| Subnet Mask: 255.255.255.0
| Router: 10.1.0.1
| Domain Name Server: 10.1.0.1
| Domain Name: lab.opencloud.io
| Response 2 of 2:
| Interface: bond0
| IP Offered: 10.1.0.27
| DHCP Message Type: DHCPOFFER
| Server Identifier: 10.1.0.3
| IP Address Lease Time: 2m00s
| Renewal Time Value: 1m00s
| Rebinding Time Value: 1m45s
| Subnet Mask: 255.255.255.0
| Broadcast Address: 10.1.0.255
| Router: 10.1.0.3
|_ Domain Name Server: 10.1.0.3
WARNING: No targets were specified, so 0 hosts scanned.
Nmap done: 0 IP addresses (0 hosts up) scanned in 10.31 seconds

https://www.redhat.com/sysadmin/finding-rogue-devices

[leenowell]

Thanks @mikeliuk 

I tried running that on my network more out of interest than anything.  I had to remove the -e bind0 but it did the trick and thankfully no rouge DHCP servers for me 🙂  All details looked correct

thanks

Lee.