Another weird AX86U issue - but not Malware?

[ahab]

RT-AX86U from 2020. Merlin 3004.388.8_2 (latest). I do not use ASUS DDNS and have never enabled AICloud. I have one port open for OVPN and one for VNC. All lights and WiFI work and MAC addresses are all normal so I really don't think this is related to the current malware situation but something went funky last night.

I have LAN-only access to the web config and from there I can still do speed tests (800mbps down / 900mbps up) and pinging my ISP still works on the Network Tools page so the router itself is getting out. None of this works from a machine on the LAN side and it appears my DNS is dead. Every webpage reports either "server not responding" or "DNS issue". I have tried reconfiguring DNS to every setting available, and removed DNScrypt from amtm, disabled Skynet, etc. I was unable to update anything in amtm so that made me think DNS was broken, no servers could be connected, but this doesn't explain no pinging from any machines on the inside. I placed one machine in the DMZ and still no love. Strangely, If I VPN in from the outside with both LAN and Internet enabled in the the tunnel, everything works fine for the VPN client. The LAN side also operates fine between local clients but anything on the inside can't get out, ever. I've restored the config and reloaded the JFFS from backups I took last week when everything worked but still the same result. The only thing I haven't done is a factory reset, I can but was hoping only as a last resort. Any ideas? Anyone have this situation before? Next steps? TIA.

 

[ATLga]

RT-AX86U from 2020. Merlin 3004.388.8_2 (latest). I do not use ASUS DDNS and have never enabled AICloud. I have one port open for OVPN and one for VNC. All lights and WiFI work and MAC addresses are all normal so I really don't think this is related to the current malware situation but something went funky last night.

I have LAN-only access to the web config and from there I can still do speed tests (800mbps down / 900mbps up) and pinging my ISP still works on the Network Tools page so the router itself is getting out. None of this works from a machine on the LAN side and it appears my DNS is dead. Every webpage reports either "server not responding" or "DNS issue". I have tried reconfiguring DNS to every setting available, and removed DNScrypt from amtm, disabled Skynet, etc. I was unable to update anything in amtm so that made me thing DNS was broken, no servers could be connected, but this doesn't explain no pinging from any machines on the inside. I placed one machine in the DMZ and still no love. Strangely, If I VPN in from the outside with both LAN and Internet enabled in the the tunnel, everything works fine for the VPN client. The LAN side also operates fine between local clients but anything on the inside can't get out, ever. I've restored the config and reloaded the JFFS from backups I took last week when everything worked but still the same result. The only thing I haven't done is a factory reset, I can but was hoping only as a last resort. Any ideas? Anyone have this situation before? Next steps? TIA.

Things usually go south fast after a factory reset, country code missing error most frequent
If it’s the same thing…

 

[Tech9]

Any ideas?

You obviously have DNS issues to clients. The router itself uses the servers defined in WAN settings and they work. Whatever you installed additionally - remove, reinstall, test again. Test with and without it and you'll find the issue. Keep it simple and your life will be better.

 

[ATLga]

Factory reset from gui along with initialize may be best after all

 

[ahab]

Thanks for the responses! I left this out of my initial post because it seemed superfluous but I was streaming F1 in one room last night and paused it, then went into another room 10 minutes later to resume on a different PC. That PC has no mouse/keyboard so I VNC to it from my phone to control it. Wouldn't connect. Went back into the first room and that's when things started to unravel. Couldn't get any webpages to load. Work laptop wouldn't connect to its VPN, etc. It was late so I went to bed and sure enough, it wasn't a dream. When I got up everything was still effed. The reason I mention all this is because nothing changed, it suddenly broke. I updated the latest Merlin on the 9th (the date of my backups) and everything was fine until out of nowhere last night.

I'm not 100% sure on where the DNS resolution is coming from when I'm VPN'd in but the Traffic Analyzer in the gui definitely shows the traffic going across the ASUS. I tried running dnscheck.tools and got varying results from different machines that were VPN'd in through different cell providers. I assume this is the result of DNS caching?

@ATLga, are you saying that the factory reset could cause the malware to wreak more havoc, if that's in fact what's going on?

 

[ATLga]

Thanks for the responses! I left this out of my initial post because it seemed superfluous but I was streaming F1 in one room last night and paused it, then went into another room 10 minutes later to resume on a different PC. That PC has no mouse/keyboard so I VNC to it from my phone to control it. Wouldn't connect. Went back into the first room and that's when things started to unravel. Couldn't get any webpages to load. Work laptop wouldn't connect to its VPN, etc. It was late so I went to bed and sure enough, it wasn't a dream. When I got up everything was still effed. The reason I mention all this is because nothing changed, it suddenly broke. I updated the latest Merlin on the 9th (the date of my backups) and everything was fine until out of nowhere last night.

I'm not 100% sure on where the DNS resolution is coming from when I'm VPN'd in but the Traffic Analyzer in the gui definitely shows the traffic going across the ASUS. I tried running dnscheck.tools and got varying results from different machines that were VPN'd in through different cell providers. I assume this is the result of DNS caching?

@ATLga, are you saying that the factory reset could cause the malware to wreak more havoc, if that's in fact what's going on?

If you read the various ongoing malware threads, there are several that did a factory reset and that’s when the missing country code error started showing. That’s why I would caution about doing that. Give it a bit and see if someone else jumps in with some troubleshooting tips on the dns

 

[ATLga]

Post 3 has good advice

 

[ahab]

OK, I had read that. Just wanted to be clear in that mine shows none of the reported symptoms. I'm not 100% certain that's not what's going on however. I plan to continue to troubleshoot and run off the old VZ router for now. Thanks again.

 

[ahab]

I agree with Tech9 with regard to a simple methodic approach for sure but apart from the latest Merlin, I haven't made any changes to the router's config in months.

 

[bbunge]

Ports open? Open port for VNC not good. For OVPN? Best to change the default port on the router OVPN server and there is no need to open any ports.