topic Re: Plus Two DNS Issues in My Router

Plus Two DNS Issues

Harddrive — Sat, 30 Jul 2022 15:22:02 GMT

Since moving to a Hub Two from a Hub One, I’ve been encountering SSL certificate errors on Windows with Outlook and Edge. It seems to be DNS related. Outlook 365 may issue a message box describing the error allowing me to click Yes but not always. Outlook 365 reports Issued To: cloudflare.dns.com.

I have great difficulty getting Outlook 365 to download e-mails (trying to connect to Outlook.com).

I can sometimes but not always get round the problem by issuing

Ipconfig /release

Ipconfig /flushdns

Ipconfig /renew

My internet security system throws up error messages for Edge (Chromium) and Bing related certificates. These errors are basic messages and don’t identify certificate information but I assume it is Cloudflare again. I can however still use Edge to browse web pages.

Also, I have two PCs which have intermittent connection issues via the Hub Two. Let’s call them PC1 and PC2. Although they are both ethernet connected to the same local network, I can’t sometimes connect to them using UNC (e.g. \\PC2\c from PC1 reports PC2 cannot be accessed) until I connect to the internet. Windows Sync Centre also does nothing until I connect to the internet. Then I can access them. If I disconnect from the internet, the UNC connection sometimes only lasts a couple of minutes then afterwards I get the same “cannot access” problem as before. Yet other times the connection still works. When I can access via UNC a Ping for the remote (e.g. Ping pc2 -n 1) from PC1 shows an IPv6 address. When I can’t it shows as something like 127.1.1.1.

I’m running with the defaults on the Hub Two – except I’ve changed the Wireless Network names and passwords and turned UpNp off – the same as I did on the Hub One. Just for a test I re-enabled UpNp but it made no difference.

To verify this is a Hub Two issue, I went back to using the Hub One and all the problems disappeared. I ran for a few days with this then went back to the Hub Two – and all the problems returned.

The strange thing is that when the Ethernet cards allow the router to assign the DNS server addresses – which for the Hub One and Two is 194.168.1.254 - when connected to the internet, the router’s DNS addresses show as 212.159.6.9 and 10 – same for both the Hub One and Hub Two.

I get the same problems with the Plus Two whether I let the router set the DNS server address for the Ethernet card (192.168.1.254) or whether I code the Plusnet “alternate” ones 212.159.6.49 and 50.

I assumed Plusnet has its own DNS servers so I’m surprised Cloudflare-dns appears in Outlook’s certificates but I may be misunderstanding how DNS works.

So I can only assume there is something different in the way the Hub Two handles DNS requests vs the Hub One.

Is this a Hub Two bug? I once had a similar issue with the Hub One till a later firmware release appeared to fix it. The Hub Two certificate problem is causing me serious issues trying to use the PC especially with Outlook.

Re: Plus Two DNS Issues

Baldrick1 — Sat, 30 Jul 2022 15:33:30 GMT

@Harddrive

I don’t know if it would help but are you aware that you are not constrained to using the Plusnet DNS resolvers with a Hub 2?

Re: Plus Two DNS Issues

Harddrive — Sat, 30 Jul 2022 18:53:14 GMT

Thanks for the suggestion.

I have seen a place where the primary and secondary DNS servers can be specified in the router IPv4 Configuration pages. I set it to the Plusnet servers as an experiment before I tried coding them on the Ethernet card but it didn't make any difference.

You've given me food for thought to perhaps look into the world of alternate DNS servers if Plusnet cannot provide a solution using their DNS servers.

Thanks

Re: Plus Two DNS Issues

Harddrive — Tue, 02 Aug 2022 15:33:27 GMT

Hello

I tried experimenting with the following DNS resolvers - specified in the IPV4 Config page of the router and when that didn't work, I specified them on the Ethernet card. But that didn't work either. (I Ipconfig'd release, flushdns, renewed and even rebooted the two machines)

I'm still getting the same issues as using the Plusnet DNS resolvers.

The Plus Two must be doing something different to the Plus One because the latter gave me no errors, even though I am using the same IPV4 addresses for the machines and the Plusnet DNS resolvers.

Can someone explain what the difference is?

Re: Plus Two DNS Issues

Harddrive — Tue, 02 Aug 2022 15:35:00 GMT

After all that, I noticed the paste of the DNS resolvers I tried didn't work.

I meant to paste in the following:

Quad9
Google
Cloudflare

Re: Plus Two DNS Issues

bobpullen — Tue, 02 Aug 2022 17:15:56 GMT

@Harddrive wrote:

I tried experimenting with the following DNS resolvers - specified in the IPV4 Config page of the router and when that didn't work...

I would suggest that the hub is rebooted after specifying custom DNS addresses in the IPv4 configuration settings. This assigns the DNS addresses to devices as part of the DHCP lease. If any devices are holding onto a prior lease, then they may not use the DNS server addresses you have changed to. A reboot should force all devices to grab a new lease.

Regardless, you can determine the DNS server address being used by a connected windows machine by running ipconfig /all from a command line and checking what DNS Servers are listed under the network adapter you are using.

I specified them on the Ethernet card. But that didn't work either. (I Ipconfig'd release, flushdns, renewed and even rebooted the two machines)

Again, if the machine shows via ipconfig that it's configured with the DNS addresses you have explicitly specified on the ethernet card, then that is very likely what it is using and would point to an issue unrelated to the servers you are using for DNS. The hub has little part in DNS resolution when you are running in this configuration other than to route the DNS packets to/from their destination.

I'm still getting the same issues as using the Plusnet DNS resolvers.

The Plus Two must be doing something different to the Plus One because the latter gave me no errors, even though I am using the same IPV4 addresses for the machines and the Plusnet DNS resolvers.

Can someone explain what the difference is?

There are no fundamental differences that I'm aware of.

I can't help but think something on your network or one/more of your local machines is giving way to this behaviour.

I get that you say you don't have problems with the Hub One, but from what you've tried, this does not strike me as solely a hub issue.

Edit: perhaps you can share some of these certificate warning errors you're seeing?

Re: Plus Two DNS Issues

Harddrive — Wed, 03 Aug 2022 20:27:24 GMT

Hello Bob

Thanks for the reply. I did do Ipconfig /all after every change to verify I was using the expected DNS addresses.

For the difference between the Plus One and Plus Two one thing that comes to mind. With the Plus One I don't think there was any IPv6 support whereas the Plus Two does have limited support. It may be a red herring but I came across someone on the web who had Outlook problems and it was suggested the problem could be an IPv6 DNS address was being returned when an IPv4 address was expected.

If I turn off Encrypted Web Page Scanning in my internet security product, the certificate errors for MsEdge disappear. For Outlook they disappear too if I have the Ethernet card set to Obtain DNS addresses automatically. But if I specify the DNS addresses of 212...49 and 212..50 the certificate errors return - except the Issued By name changes from Untrusted BitDefender CA to DigiCert TLS Hybrid ECC SHA384 2020 CA1.

I did try to attach png and text files of the certificate errors but it will only attach 1 file. When I go to attach a second one it overwrites the first one. I tried zipping them up but it won't accept a zip file.

Had I not had a Plus One with no issues I would be thinking the internet security product was at fault but as soon as I reconnect the Hub One instead of the Hub Two all these issues go away without the need to turn of SSL scanning or make any other changes.

Re: Plus Two DNS Issues

bobpullen — Thu, 04 Aug 2022 11:54:51 GMT

DNS servers will return IPv6 addresses (where applicable) whether the hub supports IPv6 routing or not.

You can try disabling some of the local IPv6 routing on the Hub Two in the Advanced Settings of the Hub Manager. Again, any changes made here and I would suggest a reboot afterwards.

If sites/services are presenting TLS certificates that are not owned by the site/service being accessed then I see no way this can be the sole fault of the router. Something else on the network has to be contributing to it. The hub has limited TLS certificates installed and none of them match what you're describing.

Re: Plus Two DNS Issues

greygit — Thu, 04 Aug 2022 23:48:58 GMT

"I would suggest that the hub is rebooted after specifying custom DNS addresses in the IPv4 configuration settings."

Can I ask why the Hub2 doesn't use DHCP to assign the DNS servers it gets from the PN servers rather than trying to act as a DNS server itself? I can understand that a modem trying to exercise levels of parental controls would need to act as a DNS server, but the Hub2 doesn't have those capabilities. IYSWIM.

Re: Plus Two DNS Issues

bobpullen — Fri, 05 Aug 2022 06:14:29 GMT

@greygit - I imagine that has something to do with the fact that DHCP leases are typically issued before the PPP session is established, and it's the PPP establishment that assigns the PN DNS addresses.

Re: Plus Two DNS Issues

greygit — Sat, 06 Aug 2022 01:36:10 GMT

Would a DHCPFORCERENEW after the PPP negotiations get past the anomaly? Or would that only force a change of IP address?

Re: Plus Two DNS Issues

Harddrive — Sat, 06 Aug 2022 15:49:28 GMT

Bob,

I looked into what IPv6 I could turn off and I could only see IPv6 Allocation. I changed it from Stateless to Off but this made no difference. I only wanted to do this briefly for a test so I've set it back to Stateless.

I did reboot the router after making the changes.

The internet connection seems to "drop" - Outlook 365 will suddenly report "You'll need the internet for this" and e-mails will stop - and the network status according to Windows changes to "No internet access" - yet I can still access websites via the browser. Sometimes the system will recover on its own, e-mails will come through again and the network status will change back to "Internet access" but sometimes I need to issue Ipconfig /release, /flushdns, and /renew...

Re: Plus Two DNS Issues

Harddrive — Fri, 12 Aug 2022 14:42:47 GMT

Having done further testing, the issue seems to revolve around DNS at internet connect/disconnect time.

It manifests itself as Outlook certificate/connection problems, invalid Edge/Bing certificates and access denied to any other PC in the workgroup. If I connect to the internet then ipconfig /release, /flushdns, /renew, the problems get resolved. As soon as I disconnect, all the problems return, some immediately.

I am beginning to suspect the problems occur when the internet is disconnected and reconnected via the Hub Two web page. There was a period when the internet was connected continuously for 4 days and I didn’t see any Outlook, Edge/Bing, or any other DNS related issues.

I know there is a known issue with the password being lost on the connect web page. I am wondering if another piece of code in that area has been altered/deleted regarding DNS handling or perhaps a not connected state has not been considered for DNS when writing the code.

It does seem that the Plus Two assumes an always-on connection state is the desired state. If the power goes off and on again on the Plus Two it always reconnects to the internet automatically even if it wasn’t connected when the power went off. Whereas the Plus One would always honour the internet connection state as it was at power off time when the power gets restored.

Certainly I never hit these issues on the Plus One. There must be a difference somewhere in how the Plus One and Plus Two handle connect/disconnect. I could happily connect/disconnect frequently on the Plus One with none of these issues.

Re: Plus Two DNS Issues

bobpullen — Fri, 12 Aug 2022 15:07:07 GMT

Why are you you repeatedly dropping the Internet connection? What purpose is this serving?

I'm a bit confused now. Obviously you're not going to have Internet access/DNS resolution if the router is offline

Re: Plus Two DNS Issues

Harddrive — Tue, 16 Aug 2022 14:36:59 GMT

In answer to question 1, a fair amount of work I do on the PC is offline and doesn't need an internet connection so I only connect when I need it and disconnect when finished. It is a habit from when I connected via dial up modem, and continued when I got the Plusnet Hub Zero and Hub One routers. There are two reasons, the major one is security. The less time I'm connected the less chance of being hacked, especially at times when the internet security software is not fully running e.g at bootup time or due to error. The other is it cuts out invisible background data going back and forth.

The router wen pages allow internet connect/disconnect so it is not as if I am doing anything the router is not built to handle (the broadband side is still connected - it is just the internet I connect/disconnect from.

I appreciate that I'm not going to have an internet connection/DNS resolution when disconnected but it seems when reconnecting, DNS seems to get screwed up when using the Plus Two. This never happened with the Hub Zero, and was an initial problem with the Plus One until a later firmware fix (which you were instrumental in resolving). The Plus One was never a problem following that in the two or so years I used it after that,

Re: Plus Two DNS Issues

bobpullen — Tue, 16 Aug 2022 15:08:22 GMT

Personally, I think you're creating problems for yourself with this behaviour.

Both the router's firewall and the native security solutions provided with most modern operating systems are pefectly adequate in terms of keeping you safe. Add to this the fact that many applications these days expect an always-on connection, and that probably includes your security software.

If you can browse then the problem cannot be solely the fault of the router's DNS forwarding/DHCP allocation. Browsing wouldn't be possbile if it was. You also say you've tried explicitly setting DNS on the affected machine itself and this hasn't helped. In this configuration the router has very little to do with the DNS resolution process.

During a time the problem exists, what is the output of the commands below?: -

route print nslookup bbc.co.uk 212.159.6.10 nslookup bbc.co.uk 192.168.1.254

Whilst I recognise you don't have this problem with the Hub One, I'm still not seeing anything specific that suggests the router is doing something it shouldn't, and given the niche setup you have, it's going to be very tricky to replicate.

Re: Plus Two DNS Issues

Harddrive — Mon, 22 Aug 2022 16:00:01 GMT

Hello Bob.

Route print while disconnected and then reconnected (with connection error problems) and then after ipconfig /release, /flushdns, and /renew is exactly the same so I have just included one:

===========================================================================
Interface List
2...f0 1f af 20 d1 03 ......Intel(R) 82579LM Gigabit Network Connection
6...3c a9 f4 51 45 44 ......Intel(R) Centrino(R) Ultimate-N 6300 AGN
17...3c a9 f4 51 45 45 ......Microsoft Wi-Fi Direct Virtual Adapter
12...3e a9 f4 51 45 44 ......Microsoft Wi-Fi Direct Virtual Adapter #2
1...........................Software Loopback Interface 1
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.254 192.168.1.112 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
192.168.1.0 255.255.255.0 On-link 192.168.1.112 281
192.168.1.112 255.255.255.255 On-link 192.168.1.112 281
192.168.1.255 255.255.255.255 On-link 192.168.1.112 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
224.0.0.0 240.0.0.0 On-link 192.168.1.112 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
255.255.255.255 255.255.255.255 On-link 192.168.1.112 281
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 331 ::1/128 On-link
2 281 fe80::/64 On-link
2 281 fe80::9cf:65a5:b63d:33d5/128
On-link
1 331 ff00::/8 On-link
2 281 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

Nslookup bbc.co.uk 212.159.6.10 after reconnection (and connection error problems) and then after ipconfig /release, /flushdns, and /renew is exactly the same so I have just included one:

Server: cdns02.plus.net
Address: 212.159.6.10

Non-authoritative answer:

Name: bbc.co.uk
Addresses: 2a04:4e42::81
2a04:4e42:200::81
2a04:4e42:400::81
2a04:4e42:600::81
151.101.0.81
151.101.64.81
151.101.128.81
151.101.192.81

Nslookup bbc.co.uk 192.168.1.254 after reconnection (and connection error problems) and then after ipconfig /release, /flushdns, and /renew is exactly the same so I have just included one:

Server: UnKnown
Address: 192.168.1.254

Non-authoritative answer:

Name: bbc.co.uk
Addresses: 2a04:4e42::81
2a04:4e42:200::81
2a04:4e42:400::81
2a04:4e42:600::81
151.101.0.81
151.101.64.81
151.101.128.81
151.101.192.81

Thanks for all your help so far.

I understand there are plans to move the phone network to IP by 2025 and therefore phones will need to be connected via the router. Do you happen to know if just a broadband connection would be needed to make and receive phone calls or would an internet connection also be required?

Re: Plus Two DNS Issues

bobpullen — Mon, 22 Aug 2022 16:20:28 GMT

At a cursory glance, I can't see anything untoward with any of that output, and the nslookup commands in particular show that DNS resolution is perfectly fine both direct to the server and via the hub's DNS forwarder.

Any VoIP telephony service will require an active Internet/IP session. The physical data link would not be sufficient.

Re: Plus Two DNS Issues

greygit — Mon, 22 Aug 2022 23:54:05 GMT

@bobpullen

"Any VoIP telephony service will require an active Internet/IP session. The physical data link would not be sufficient."

Do mobile phone connections rely on an active Internet/IP session? Or do they rely on stuff below the IP level? I'm thinking not, as my mobile doesn't "do" the internet. In case you're wondering, I only have a minibrick for two-factor authentication of financial stuff. Separating technologies makes things just that little more secure.

This is going to go off-topic, I suspect. I will note that banking institutions have previously abandoned VoIP. Which may explain why they like their customers to have a separate technology path for 2-factor authentications. They do prefer a mobile number, even if it is only used for text messaging services.

Re: Plus Two DNS Issues

Harddrive — Wed, 24 Aug 2022 16:10:10 GMT

@bobpullen and everyone else who tried to help, thanks.

It looks like one of these problems that isn't going to be solved so I'll leave it at that.