DNS Hijacking R8000P- presenting errors, requires fresh frequently

[nnagreg]

For the past several months,  I've noticed the when using my router as the DNS server,  it appears to act odd, "Site cannot be reached" ,  "DNS address could not be found. Diagnosing the problem" especially to NEW sites or sites that I infrequently visit.   

At first I thought maybe it was my ISP,  thus I changed within the router the DNS to 8.8.8.8 along with a variety of DNS servers, single and multiples.  -The problem still persisted

I've then set my local DNS settings to go directly to the 8.8.8.8 - The problem goes away.

This happens with a variety of devices, OSes, & browsers:     Windows 10/11,  RPI, and Android, Edge, Chrome, Brave ( errors out 1st then usually refreshes automatically in about 10 seconds)

Any Ideas?

Thank you in advance, Greg

Some information about my router:

 R8000p Firmware: V1.4.2.84_1.3.42  GUI:  V1.4.1.70_2.1.46.1  IP6V disabled

Debug information pulled today (3/22/2022)   (All files have old odd dates 9/11/2021 - only places that recent files are in /tmp/d2d)

dhcp_dns=8.8.8.8

wan_dns=0.0.0.0
wan_dns1=8.8.8.8
wan_dns_sel=1

services:
15988 nobody 4140 S dnsRedirectReplyd
16068 nobody 1960 S dnsmasq -h -n -c 0 -N -i br0 -r /tmp/resolv.conf -I

16144 nobody 6244 S ddnsd &

========nslookup www.google.com===========
Server: 8.8.8.8
Address 1: 8.8.8.8 dns.google

Name: www.google.com
Address 1: 142.250.190.68 ord37s34-in-f4.1e100.net
Address 2: 2607:f8b0:4009:804::2004 ord38s18-in-x04.1e100.net
========nslookup www.netgear.com===========
Server: 8.8.8.8
Address 1: 8.8.8.8 dns.google

[nnagreg · Accepted solution]

UPDATE 4/18/2022

Work Around  (Solved)

Enabled - IPV6 Auto  (set to 6to4 Tunnel)

Hi All,

By enabling IPv6,  the problem went away.

Hope this helps!!

Greg

[FURRYe38]

What is the Mfr and model# of the Internet Service Providers modem/ONT the NG router is connected too?

There is many other posts about DNS issues seen on recent 8 series router FW. 

Some report that enabling IPv6 can help. Others mention reverting back to prior working FW version. 

NG is aware of the DNS issues. No idea when a fix will be forth coming. 

[nnagreg]

ISP: Midcontinent Communications

Manufacturer: HITRONModel: CODA-45

[FURRYe38]

CODA-45?? 82? 

There should be 4 numbers to the model of this modem...

[nnagreg]

I've confirmed the Model is CODA-45  (No other numbers)

https://us.hitrontech.com/products/service-providers/coda-45-cable-modem/

Thank you!

[FURRYe38]

Ok, just checking to be sure. 

I recommend you downgrade FW to v.62 and after that's loaded, factory reset the router and setup from scratch. 

[nnagreg]

******** UPDATE *************

4/18/2022

Any thoughts?  Problem still exists

New Firmware applied:   V1.4.3.88_1.3.50

Did a Factory reset and completely re-built the router configuration using the WEB interface.

Problem still exists using windows 11 device :  

Seeing 'DNS_PROBE' errors,

Still requires F5 refresh to continue to website during first request  

AND now the router does not supply my manual DNS entries to the clients.

Detail below

----------------

Advanced Internet Setup:

Get Dynamically from ISP
Use Static IP Address
IP Address 192.168.88.8
IP Subnet Mask 255.255.255.0
Gateway IP Address 192.168.88.253

IP Address	192.168.88.8
Subnet Mask	255.255.255.0
Default Gateway	192.168.88.253
DNS Server	8.8.8.8

Domain Name Server (DNS) Address
X Use These DNS Servers
Primary DNS 8.8.8.8
Secondary DNS  blank

Client DHCP info:

IP =  192.168.99.10  (Client IP)

Netmark 255.255.255.0

Gateway:  192.168.99.3

DNS Server = 192.168.99.3 (Its the internal Router IP)

NSLOOKUP  (new Domain names are returned immediately)

> server
Server: UnKnown
*** UnKnown can't find server: Non-existent domain

[FURRYe38]

Seems like the router is getting a private IP address (192.168.88.#) instead of a public address, ##.##.###.###.

Looking at the modem seems like it doe not have a built in router however wondering if the ISP has it configured differently. 

Can you check with the ISP to see if they have the modem configured differently and see if the modem can pass thru a public IP address? 

[nnagreg · Accepted solution]

UPDATE 4/18/2022

Work Around  (Solved)

Enabled - IPV6 Auto  (set to 6to4 Tunnel)

Hi All,

By enabling IPv6,  the problem went away.

Hope this helps!!

Greg

[nnagreg]

Yes, this DHCP behavior is odd with the current version of the firmware.

With my ISP, I've elected to not accept the DNS entries from the provider (Midco.net)

Good news is that I was able to resolve the problem with DNS multiple requests,  see my posted down below.   However,  my DHCP clients still point to the router as the DNS server,  odd.

Thanks for the help!

[FURRYe38]

Ok glad that worked. 

FYI all NG routers use DNS proxy for connected device. NG may have close what you saw in recent FW version.

Glad you got it working. Please mark your thread as solved so others will know. Be sure to save off a back up configuration to file for safe keeping. Saves time if a reset is needed.
https://kb.netgear.com/24231/How-do-I-back-up-the-router-configuration-settings-on-my-Nighthawk-rout...
Enjoy. 📡

[mkrejci]

Thanks, I just setup my R8000P yesterday and have had constant DNS issues with it. I am trying your suggestion regarding turning on IPV6 and will report later if it worked or not.