Weird website issue - seem to be something with the router..

[Pierino]

Try with dd-wrt on it just for kicks.

 

[ex313]

Try with dd-wrt on it just for kicks.

I found a version of DD-WRT for the Ac-1900P and it fixed the issue. I still prefer running Merlin, maybe at this point a flash back will fix the issue. Unless there are any other ideas to try and address the issue. Seems pretty obvious something got corrupted - doesn't seem like it was a hardware issue.

 

[dave14305]

I will pull power on the cable modem, give it a 20 minuted and it should pull a new IP.

So did this not change the outcome, or did you also switch to ddwrt during that 20 mins?

 

[follower]

If I browse to this website:
http://heroesforhire.us

I get a page off this website:
https://www.spiceoflifepharmacy.com

1. It only happens on devices connected to the router.
2. It happens on two different PC, all browsers and my android mobile
3. If I engage the VPN on the PC or switch to Verizion data - I get the correct website.
4. If I bypass the router and connect directly to Spectrum - I get the correct site.
5. I have tried a power reset, changing DNS servers - nothing changes it.
6. Cleared browser data, Windows DNS Cache - no effect.
7. If I navigate to any subpage the correct site comes up. (ex: http://heroesforhire.us/?page_id=17)

I am running an AC-1900P on 384.13. Did a full reset on the last firmware update, is there something I am missing?? Some routing table setting or cache that I have failed to clear?

Thanks !

Is that a refurbished or used 1900P?

 

[ex313]

So did this not change the outcome, or did you also switch to ddwrt during that 20 mins?

The WAN IP didn't change when I swapped out the AC-1900P with the WRT-54. So by that I would conclude that the webserver was doing what it should and not giving our WAN IP weird content.

 

[ex313]

Is that a refurbished or used 1900P?

I think it was a refurb through Newegg, been running fine for two years now.

 

[ex313]

DD-WRT wasn't running the best on this router. 2G throughput was sketchy and clients had trouble accessing via 5G. reloaded 384.13 via rescue mode and the router is back to giving me erroneous sites.
Looks like its time to replace the router.

 

[dave14305]

DD-WRT wasn't running the best on this router. 2G throughput was sketchy and clients had trouble accessing via 5G. reloaded 384.13 via rescue mode and the router is back to giving me erroneous sites.
Looks like its time to replace the router.

Do you see this with other URLs besides the one in this thread?

 

[miroco]

What does the system log say?

 

[ex313]

Do you see this with other URLs besides the one in this thread?

This is the only one I have discovered.
I have seem a few other anomalies with this unit such as wifi dropouts, slow site/dns resolves. Was not enough to worry about it, but this seems a little weird.

 

[ex313]

I did some more messing around with the router this morning.
I set up my PIA VPN on the router, and going through the VPN the result is still the same - which pretty much rules out any webserver/ISP issues - its solely focused on the router.

 

[dave14305]

I did some more messing around with the router this morning.
I set up my PIA VPN on the router, and going through the VPN the result is still the same - which pretty much rules out any webserver/ISP issues - its solely focused on the router.

If you ssh to the router, and run these commands, see if anything looks unusual/unexpected. Post the results if you are comfortable doing so. Looking for rogue web processes or dns processes, or iptables rules, unexpected partitions, etc.

netstat -nltup
iptables -t nat -S
cat /etc/dnsmasq.conf
cat /tmp/resolv.dnsmasq
df

 

[ex313]

If you ssh to the router, and run these commands, see if anything looks unusual/unexpected. Post the results if you are comfortable doing so. Looking for rogue web processes or dns processes, or iptables rules, unexpected partitions, etc.

netstat -nltup
iptables -t nat -S
cat /etc/dnsmasq.conf
cat /tmp/resolv.dnsmasq
df

See attached txt files.

 

[dave14305]

See attached txt files.

Nothing looks out of the ordinary. I might disable WPS under WiFi. Are you aware of those port forwards for 3074 and 3075? Just want to make sure they're intentional. You can probably delete the iptable.txt attachment since it includes your WAN IP and you don't need anymore problems.
I don't have a mastiff process on my router, but it's apparently part of the firmware. Do you use any IFTTT or AsusCloud?

 

[ColinTaylor]

Are you aware of those port forwards or 3074 and 3075?

They're normal. It's for the Sony PlayStation Network (I think the xbox might use the same ports as well).

 

[dave14305]

How about running this on the router and seeing if the HTML looks like it's from the correct site or not?

curl -v http://heroesforhire.us/ | more

or save it to a file:

/tmp/home/root# curl http://heroesforhire.us/ -o hero.htm
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  665k    0  665k    0     0  65333      0 --:--:--  0:00:10 --:--:--  161k
/tmp/home/root# ll
-rw-rw-rw-    1 admin root        681885 Oct 26 15:00 hero.htm

 

[ex313]

How about running this on the router and seeing if the HTML looks like it's from the correct site or not?

curl -v http://heroesforhire.us/ | more

or save it to a file:

/tmp/home/root# curl http://heroesforhire.us/ -o hero.htm
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  665k    0  665k    0     0  65333      0 --:--:--  0:00:10 --:--:--  161k
/tmp/home/root# ll
-rw-rw-rw-    1 admin root        681885 Oct 26 15:00 hero.htm

Its returning code that looks very similar to the pharmacy site - nothing like what is supposed to be on the heroesforhire page. Basically mirroring what the browser is doing.

 

[dave14305]

Its returning code that looks very similar to the pharmacy site - nothing like what is supposed to be on the heroesforhire page. Basically mirroring what the browser is doing.

Ok, just throw the router away. It’s possessed.

 

[ex313]

I have an RT-AC86U coming from Amazon today. Will see if there is any difference in performance or it fixes the problem. I have time to return if its acts the same.

 

[martinr]

I have an RT-AC86U coming from Amazon today. Will see if there is any difference in performance or it fixes the problem. I have time to return if its acts the same.

And time, if necessary, to see if an exorcist can help.