Custom firmware build for R7800 v. 1.0.2.67SF & 1.0.2.67.1SF

[decantur]

question, do you custom upstream dns servers? unless i select my router(191.168.1.1) as upstream server , then i am unable to connect to the internet. weird

I run unbound as a recursive DNS solution:

https://docs.pi-hole.net/guides/unbound/

 

[Jarkko Laine]

Yes. My internet led on my 7800 is blinking non stop 24/7 since I installed .67sf.

I have this issue also. Has somebody found a solution how to stop the constant dns requests regarding registration.ngxcld.com?
For example which process is causing that, if we could stop the process temporarily, or edit the configuration etc.

 

[Tom Brough]

I tried v2.3.7.6 of the Nighthawk app. I'm running 67SF on my router, and connected locally to it. I tried to turn remote management ON and failed; the app reports "Some error occurred while enabling/disabling remote management".

I don't use remote management myself, but it does appear that something's broken...

I'm on version 67 and my remote management works via browser or the Netgear app... I turned it on via the gui menu while connected directly and can now access it via the internet as normal...

 

[cordezz]

I'm on version 67 and my remote management works via browser or the Netgear app... I turned it on via the gui menu while connected directly and can now access it via the internet as normal...

Where do turn remote management on? Do you mean the ready cloud option?
With 67SF my router is always displayed as offline in ready cloud and in the android app. Unregister und register again does not help.

Edit: Now I see https://kb.netgear.com/24234/How-do-I-set-up-remote-management-on-my-Nighthawk-router
I dont have this option because I am running my R7800 in access point mode.

 

[ulaganath]

I'm on version 67 and my remote management works via browser or the Netgear app... I turned it on via the gui menu while connected directly and can now access it via the internet as normal...

The remote management on App and Web GUI is different. As app is limited access but GUI is full access.

The issue is not with remote Web GUI. The issue is cloud connected App. The router will be registed in cloud and will allow to remotely login to router via app and change or view basic things what ever you see in app while directly connected in home network.

You can view devices / pause internet. Initiate the remote speed test , Check or change wifi name/password and Check the Stats of usage as well reboot the router.

App works in home network and outside network via remote management.

The app shows the device is rm is enabled but the device is shown offline. Something is missing. Either the netgear is verifying the device by version or something fishy.

Hope Voxel once returns can fix this.

This is will help in a lot of situations to control and monitor the network.

 

[MinkyMomo]

Out of curiosity, I set up pi-hole in a new VM. My R7800 is on 67SF with IPv6 enabled; neither stubby nor dnscrypt is enabled. It remained responsible for DHCP, and advertised a single DNS entry that points to the pi-hole VM. pi-hole itself was configured with Cloudflare as the only upstream DNS server for both IPv4 and IPv6.

When I fired it all up, I too started to see the numerous DNS queries regarding registration.ngxcld.com. The queries appear to be related to /bin/datalib, as that executable embeds URLs pointing to that server.

I amended the router's hosts file to point registration.ngxcld.com to 0.0.0.0 and "::", and that quieted things down considerably...

 

[eevanskiteboards]

Out of curiosity, I set up pi-hole in a new VM. My R7800 is on 67SF with IPv6 enabled; neither stubby nor dnscrypt is enabled. It remained responsible for DHCP, and advertised a single DNS entry that points to the pi-hole VM. pi-hole itself was configured with Cloudflare as the only upstream DNS server for both IPv4 and IPv6.

When I fired it all up, I too started to see the numerous DNS queries regarding registration.ngxcld.com. The queries appear to be related to /bin/datalib, as that executable embeds URLs pointing to that server.

I amended the router's hosts file to point registration.ngxcld.com to 0.0.0.0 and "::", and that quieted things down considerably...

Hmmm. Maybe I will try that also. I am getting around 1 million hits a day on pi hole.

 

[kamoj]

I run a search for other possible addresses with this result:

root@R7800:/$ strings /bin/datalib | grep -iE '\.com|\.org|\.net|netgear\.' -B1
ntpserver1
time-g.netgear.com
ntpserver2
time-h.netgear.com
--
failover_detect_dns
www.netgear.com
--
genie_remote_url
https://genieremote.netgear.com/genie-remote/claimDevice
--
x_claimed_url
https://registration.ngxcld.com/registration/status
x_register_url
https://registration.ngxcld.com/registration/register
x_advisor_url
https://advisor.ngxcld.com/advisor/direct
x_discovery_url
https://presence.ngxcld.com/presence/presence
readycloud_fetch_url
https://readycloud.netgear.com/device/entry
readycloud_hook_url
https://readycloud.netgear.com/device/hook
readycloud_upload_url
https://readycloud.netgear.com/directio
--
leafp2p_remote_url
http://peernetwork.netgear.com/peernetwork/services/LeafNetsWebServiceV2
--
leafp2p_replication_url
https://readyshare.netgear.com/device/entry
--
leafp2p_replication_hook_url
https://readyshare.netgear.com/device/hook

Out of curiosity, I set up pi-hole in a new VM. My R7800 is on 67SF with IPv6 enabled; neither stubby nor dnscrypt is enabled. It remained responsible for DHCP, and advertised a single DNS entry that points to the pi-hole VM. pi-hole itself was configured with Cloudflare as the only upstream DNS server for both IPv4 and IPv6.

When I fired it all up, I too started to see the numerous DNS queries regarding registration.ngxcld.com. The queries appear to be related to /bin/datalib, as that executable embeds URLs pointing to that server.

I amended the router's hosts file to point registration.ngxcld.com to 0.0.0.0 and "::", and that quieted things down considerably...

 

[Restalfep]

Any idea how to fix this? How did you edit the hosts file? Getting millions of queries a day as well. Any help greatly appreciated. Thanks!

 

[kamoj]

#To add the the 3 ngxcld domains found, login with telnet and run these 3 commands:

echo "0.0.0.0 registration.ngxcld.com" >>/tmp/hosts
echo "0.0.0.0 advisor.ngxcld.com" >>/tmp/hosts
echo "0.0.0.0 presence.ngxcld.com" >>/tmp/hosts

#For permanent change, also add to /sbin/printhosts, using these 3 commands:

grep "0.0.0.0 registration.ngxcld.com" /sbin/printhosts || sed -i 's/^EOF/0.0.0.0 registration.ngxcld.com\nEOF/' /sbin/printhosts
grep "0.0.0.0 advisor.ngxcld.com" /sbin/printhosts || sed -i 's/^EOF/0.0.0.0 advisor.ngxcld.com\nEOF/' /sbin/printhosts
grep "0.0.0.0 presence.ngxcld.com" /sbin/printhosts || sed -i 's/^EOF/0.0.0.0 presence.ngxcld.com\nEOF/' /sbin/printhosts

For ipv6 replace 0.0.0.0 with :: in the commands above

Any idea how to fix this? How did you edit the hosts file? Getting millions of queries a day as well. Any help greatly appreciated. Thanks!

 

[Restalfep]

#To add the the 3 ngxcld domains found, login with telnet and run these 3 commands:

echo "0.0.0.0 registration.ngxcld.com" >>/tmp/hosts
echo "0.0.0.0 advisor.ngxcld.com" >>/tmp/hosts
echo "0.0.0.0 presence.ngxcld.com" >>/tmp/hosts

#For permanent change, also add to /sbin/printhosts, using these 3 commands:

grep "0.0.0.0 registration.ngxcld.com" /sbin/printhosts || sed -i 's/^EOF/0.0.0.0 registration.ngxcld.com\nEOF/' /sbin/printhosts
grep "0.0.0.0 advisor.ngxcld.com" /sbin/printhosts || sed -i 's/^EOF/0.0.0.0 advisor.ngxcld.com\nEOF/' /sbin/printhosts
grep "0.0.0.0 presence.ngxcld.com" /sbin/printhosts || sed -i 's/^EOF/0.0.0.0 presence.ngxcld.com\nEOF/' /sbin/printhosts

For ipv6 replace 0.0.0.0 with :: in the commands above

Thank you! Is there any reason not to do the permanent change yet (i.e. if it gets fixed in firmware, any reason we want those resolving as normal or doesn't matter?)

 

[kamoj]

The "permanent" change will be undone when you install new FW.
Or you can of course edit the files back to the original:

sed -i '/0.0.0.0 registration.ngxcld.com/d' /tmp/hosts
sed -i '/0.0.0.0 advisor.ngxcld.com/d' /tmp/hosts
sed -i '/0.0.0.0 presence.ngxcld.com/d' /tmp/hosts
sed -i '/0.0.0.0 registration.ngxcld.com/d' /sbin/printhosts
sed -i '/0.0.0.0 advisor.ngxcld.com/d' /sbin/printhosts
sed -i '/0.0.0.0 presence.ngxcld.com/d' /sbin/printhosts

Thank you! Is there any reason not to do the permanent change yet (i.e. if it gets fixed in firmware, any reason we want those resolving as normal or doesn't matter?)

 

[Voxel]

Hope Voxel once returns can fix this.

I'll check of course. I need some time after my arrival.

Voxel.

 

[Voxel]

I noticed that my Internet LED was blinking constantly as some others have mentioned. Rolled back to version 66SF, same behavior. Rolled back to stock version 1.0.2.62 and factory reset, same behavior. It only stops if I disconnect my cable modem from the WAN port. This doesn't see to have anything to do with the Voxel firmware.

I don't have any problems using the Nighthawk app with version 66SF or 67SF on the LAN. I haven't tried remote.

So, it is something like surprise from NG (bomb). I am not sure, maybe it is related to the problem reported by ulaganath when remote management by these apps is impossible. But if it is reproduced by flashing to stock...

Guys, as far as you can guess it is not like my intentional design ;-) The difference 67SF vs 66SF vs 65SF etc ...----> 62(stock). All these changes cannot be a reason for LED blinking. Well, I suspect that I'll have a "pleasant time" for reverse engineering...

Voxel.

 

[Deleted member 63436]

I first noticed this issue on .67 which was not occurring on version .66. In my case rolling back to version .66 stopped the 10's of thousands of queries an hour to the URL's that were posted earlier, unless the blinking constantly is unrelated to the queries. I don't look at my router since it's in the closet.

 

[Jake77]

I first noticed this issue on .67 which was not occurring on version .66. In my case rolling back to version .66 stopped the 10's of thousands of queries an hour to the URL's that were posted earlier, unless the blinking constantly is unrelated to the queries. I don't look at my router since it's in the closet.

Same for me too, I also rolled back to version .66 and that stopped the constant dns requests.

 

[Matte]

Hi guys, @Voxel I am having trouble with dnscrypt2, it's enabled in NVRAM and scripts run it, however at a reboot it does not start and I am left with no internet after any power outage. Is there further troubleshooting / recent changes that could be related? I am currently connecting via SSH at every boot to start it, noot great

Thanks! Matteo.

 

[Voxel]

Hi guys, @Voxel I am having trouble with dnscrypt2, it's enabled in NVRAM and scripts run it, however at a reboot it does not start and I am left with no internet after any power outage. Is there further troubleshooting / recent changes that could be related? I am currently connecting via SSH at every boot to start it, noot great

Thanks! Matteo.

Try to check /var/log/dnscrypt-proxy-2.log after reboot re: what it says, why dnscrypt2 is not started.

Voxel.

 

[Voxel]

I first noticed this issue on .67 which was not occurring on version .66. In my case rolling back to version .66 stopped the 10's of thousands of queries an hour to the URL's that were posted earlier, unless the blinking constantly is unrelated to the queries. I don't look at my router since it's in the closet.

Some investigation: seems ReadyCLOUD downloadable applications (pre-built by NG) are not compatible with libcurl compiled with OpenSSL 1.1.1... So roll back for curl package. Wait for a fix.

Voxel.

 

[Voxel]

Some investigation: seems ReadyCLOUD downloadable applications (pre-built by NG) are not compatible with libcurl compiled with OpenSSL 1.1.1... So roll back for curl package. Wait for a fix.

Voxel.

I mean (more details) it (ReadyCLOUD) permanently spawns child processes and they try to register on NG sites... What I could get from reverse engineering...

Voxel.