Cannot access web interface on RT-AC86U

[cmihai]

I'm on the 3rd day experiencing a very weird issue. Router has been running stable since mid-April on Merlin 386.2_2

- two days ago, I noticed my Ecobee thermostat not being able to acquire an IP address, although we had internet on every other device. Tried accessing the router at 192.168.1.1, no go. ipconfig showed me a default gateway of 192.168.50.1, to which I could get to the login screen on the GUI.
Weird info 1) I had it setup on 192.168.1.1 for months, and do not understand how it did reset its internal IP address to the default 192.168.50.1
Weird info 2) I tried logging in via GUI (at its new IP address 192.168.50.1) and couldn't get in; I tried regular user and password, no go; I tried admin with the default "password" (thinking since IP fell back to the default one, maybe password did the same), no go; I tried admin with no password, no go; similarly for root with default password and root with no password (although this should only be applicable to SSH), no luck; I simply couldn't get in via GUI and I know the password very well, so there is no chance I misplaced it
Weird info 3) when this thing happens, it drops both 2.4 and 5GHz wireless signals; luckily, I have another Access Point that our devices can fall back to, otherwise we would be with no wireless signal

I first power cycled it (by pulling out the power cord, waited a minute and placed it back in) with no success. The only other option I could think of was to reset to factory default via the reset button on the back. After it came back, I could set it up as wireless router mode, reconfigure it, reboot it and everything was back to normal at least for a few hours in the evening

- the following day, yesterday, I was back to square one, the router reverted on its own to the default internal IP address (50.1) and couldn't get in via GUI in any way. I though maybe something is off with the firmware and after the factory reset and reboot, I upgraded to the latest version, 386.2_6 since I was at it. I followed the following sequence: flash, factory reset, reconfigure, reboot. It was late at night, but everything was operating normal for a few hours in the evening

-today the router decided to act again and couldn't get in. After the factory reset and reboot, I downgraded 386.2_2 version that was stable for months in the past. I followed the following sequence: flash, factory reset, reconfigure, reboot. Now, in the evening, after a few hours, I have the same issue.

Firmware version does not seem to play a role, as independent of it, it does the same thing. It is very annoying, I spent at least one hour for the last few days

Any idea what I can check and if there are other ways to get into it? Unfortunately, I have not enabled the SSH. I bought the router brand new in April, about 3 months back and it was solid until a few days ago

Thanks

 

[Tech9]

Do you have Web Access form WAN enabled in Administration, System?
Do you use the same username and password every time when setting up the router?

 

[ColinTaylor]

Sounds like a hardware issue. Make sure it's not overheating. Put a fan next to it and see if that stops it resetting itself.

Try a username/password of admin/admin. If you can log in with that look for clues in the system log.

 

[cmihai]

Do you have Web Access form WAN enabled in Administration, System?
Do you use the same username and password every time when setting up the router?

Thanks for the reply, I did not enable Web Access and I did use the same username and password every time. Should I try a different username and password?

 

[cmihai]

Sounds like a hardware issue. Make sure it's not overheating. Put a fan next to it and see if that stops it resetting itself.

Try a username/password of admin/admin. If you can log in with that look for clues in the system log.

Thanks for the reply, I tried both combinations and no go, unfortunately

 

[Tech9]

If you're sure there is no third party involvement, look regularly in logs for any hardware failure clues, as suggested by @ColinTaylor.

 

[cmihai]

If you're sure there is no third party involvement, look regularly in logs for any hardware failure clues, as suggested by @ColinTaylor.

Thanks, I will factory reset and reconfigure one more time tomorrow after work and monitor the system log. Not sure what third-party involvement you are referring to, but I have not installed any additional programs/extensions

 

[Tech9]

I mean someone inside your network/home accessing the GUI or pressing the Reset button. Unlikely, because you've said you had Internet on other devices, but just checking. Do you configure the router manually after reset?

 

[cmihai]

I mean someone inside your network/home accessing the GUI or pressing the Reset button. Unlikely, because you've said you had Internet on other devices, but just checking. Do you configure the router manually after reset?

I have a strong password (using a password manager software), it is unlikely that someone got into the router. If someone would have pressed the Reset button, I would have been able to get into the router with the default user and password, which is not the case, something weird is going on. I keep thinking it could be a hardware failure, may have to think about exchanging if possible. I remember looking at the CPU temperature in the past and it was around 79 degrees Celsius, which doesn't seem excessive.

Although I have configuration backups, I have read that is safer to proceed with a clean and manual setup, so although tedious the router was configured manually every time to rule out other issues. Here is the sequence that I followed: reset button on the back, wait 5 minutes, factory reset via GUI, wait 5 minutes, reconfigure manually, reboot - let me know if I should do anything differently

Today after work , I will probably configure the bare minimum and let it go for a few hours to see if the problem comes back: set internal LAN address to "1.1" (to be able to assess if it goes back to its default "50.1"), set admin password, set up wireless networks, allow SSH. Someone asked me to enable "Web Access form WAN", would probably do this as well. I will hold off on any extras such as, DDNS, AiProtection, no static internal IP assignments, no DNS servers (was using AdGuard servers to block ads), no VPN Server, no Parental Control time-based restrictions - so my teenagers would be very happy to play video games all night long

Just thinking, would it make any difference to switch back to Asus (non-Merlin) firmware?

 

[cmihai]

The other thing that comes to mind is that I can get to the GUI logon page after it acts up on 192.168.50.1, it's just that I cannot login anymore because no credentials are being accepted after it acts up. So I'm not sure how enabling "Web Access from WAN" is going to help, but I will do it regardless

 

[ColinTaylor]

I think the "Web Access from WAN" question was to make sure you didn't enable it as that could have been the source of a hacking attempt.

 

[Tech9]

Just thinking, would it make any difference to switch back to Asus (non-Merlin) firmware?

You can try that, Asus released a new firmware for AC86U yesterday. Don't enable Web Access from WAN.

RT-AC86U｜WiFi Routers｜ASUS USA

ASUS has a range of wireless routers suitable for every purpose. Whether it's for your home, for business trips, or for any other need or environment, there's an ASUS router for you.

www.asus.com

 

[cmihai]

I think the "Web Access from WAN" question was to make sure you didn't enable it as that could have been the source of a hacking attempt.

Got it, thank you, I disabled it now.

Is there something to look for in system log?

If I search for "error", I only get
May 5 05:05:16 kernel: ^[[0;33;41m[ERROR pktrunner] runnerUcast_inet6addr_event,202: Could not rdpa_ucast_ipv6_host_address_table_find^[[0m

Should I post the system log?

 

[cmihai]

One thing that I did different this time around was to setup a new, more complex, password. Just to rule out that someone or some process might have access to the old password

 

[cmihai]

You can try that, Asus released a new firmware for AC86U yesterday. Don't enable Web Access from WAN.

RT-AC86U｜WiFi Routers｜ASUS USA

ASUS has a range of wireless routers suitable for every purpose. Whether it's for your home, for business trips, or for any other need or environment, there's an ASUS router for you.

www.asus.com

Thanks, if this attempt fails, I will try Asus firmware, as the last attempt

 

[cmihai]

Is below something to be worried about?

Jul 15 18:38:20 watchdog: New firmware version 386.2_6 is available.
Jul 15 18:38:31 kernel: Init chrdev /dev/idp with major 190
Jul 15 18:38:31 kernel: tdts: tcp_conn_max = 8000
Jul 15 18:38:31 kernel: tdts: tcp_conn_timeout = 300 sec
Jul 15 18:38:33 kernel: SHN Release Version: 2.0.1 851496c
Jul 15 18:38:33 kernel: UDB Core Version: 0.2.18
Jul 15 18:38:33 kernel: Init chrdev /dev/idpfw with major 191
Jul 15 18:38:33 kernel: IDPfw: flush fc
Jul 15 18:38:33 kernel: IDPfw: IDPfw is ready
Jul 15 18:38:33 kernel: sizeof forward pkt param = 280
Jul 15 18:38:33 BWDPI: fun bitmap = 3
Jul 15 18:38:40 wlceventd: wlceventd_proc_event(527): eth6: Auth 84:5C:F3:9D:87:08, status: Successful (0), rssi:0
Jul 15 18:38:40 wlceventd: wlceventd_proc_event(556): eth6: Assoc 84:5C:F3:9D:87:08, status: Successful (0), rssi:0
Jul 15 18:38:40 dnsmasq-dhcp[1932]: DHCPREQUEST(br0) 192.168.1.242 84:5c:f3:9d:87:08
Jul 15 18:38:40 dnsmasq-dhcp[1932]: Ignoring domain ngco.com for DHCP host name LL5CG1080Y02
Jul 15 18:38:40 dnsmasq-dhcp[1932]: DHCPACK(br0) 192.168.1.242 84:5c:f3:9d:87:08 LL5CG1080Y02
Jul 15 18:38:49 kernel: IDPfw: Exit IDPfw
Jul 15 18:38:49 kernel: mod epilog takes 0 jiffies
Jul 15 18:38:49 kernel: IDPfw: Exit IDPfw
Jul 15 18:38:49 kernel: Exit chrdev /dev/idpfw with major 191
Jul 15 18:38:49 kernel: Exit chrdev /dev/idp with major 190

It's been more than 10 minutes without any additional entry in the system log

 

[cmihai]

False alarm, there is one more line in the log file

Jul 15 18:54:42 kernel: nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead.

 

[cmihai]

I am sending the system log now to a Raspberry Pi, I will see how it goes

 

[cmihai]

The router failed again, about a week in (Jul-15 to Jul-23). I am attaching the system log I captured for a full week, in case someone can provide any direction. Have been running on original Asus firmware since Jul-23

 

[cmihai]

Apparently, the attached file doesn't want to stay with the message, not sure if there is an alternate way to attach the log file