With AiProtection on I cannot visit some sites

[Joppez]

Hi,

I am running my LAN with an RT-AC68U with 384.4_2, which has never failed me before.

This started today (without any firmware upgrade or change of settings), I can no longer browse https://www.quora.com or https://eu.battle.net/login/ (and many other sites), but most sites works just as normal.

If I click the main button in Network Protection/AiProtection (the one marked Enabled AiProtection) to turn it off, everything works again. If I don't do that the sites just hangs with "Negotiating TLS Connection" in my browser.

However, since I suspected that this was connected to "Malicious Sites Blocking", I have tried to turn that off and also the two others (Two-Way IPS and Infected Device Prevention and Blocking), but turning them off one by one or even all three of them at the same time, does not help. The only thing that helps is completely disabling AiProtection, which I don't want to do.

Any ideas what the problem might be?

 

[martinr]

I’m still on 380.68_4 and have all 3 components of AIProtection running on my RT-AC68U and have no problem reaching the login pages to both of the websites you listed.

(I also run ABSolution and Skynet)

Does it happen on every device on your LAN?

 

[Joppez]

Yes, it's the same thing on all devices connected to this router. Have tried the usual stuff. Firmware reset, for instance, didn't help.

 

[Treadler]

Working fine for me here.......

 

[Vexira]

Do a signature update check.

 

[AndreiV]

Do a signature update check.

This is why I have removed AiProtection , the sig check is broken anyway, and the OP has stated he turned off the malicious site blocking which is what the signatures are for.

The only way to gain access to suddenly non working/loading pages is to shut AIProtection off totally, if it were signature issues turning off the site component would fix the problem.

 

[JacquesR]

I’m still on 380.68_4 and have all 3 components of AIProtection running on my RT-AC68U and have no problem reaching the login pages to both of the websites you listed.

(I also run ABSolution and Skynet)

Same here (86U) - ABSolution, Skynet and AIProtection enabled, and the sites both load.

 

[Vexira]

This is why I have removed AiProtection , the sig check is broken anyway, and the OP has stated he turned off the malicious site blocking which is what the signatures are for.

The only way to gain access to suddenly non working/loading pages is to shut AIProtection off totally, if it were signature issues turning off the site component would fix the problem.

Sig check work for me perfectly normal, I was half thinking it was a bug possibly needs a factory reset or to report to asus that the site has an issue, I think on a blocked page there is a way to report it as safe.

 

[AndreiV]

Sig check work for me perfectly normal, I was half thinking it was a bug possibly needs a factory reset or to report to asus that the site has an issue, I think on a blocked page there is a way to report it as safe.

I think you are misunderstanding the problem.

This is not a page being blocked as malicious, there is no TM blocking page/warning.

What happens is that sites fail to load and you get a variety of browser problems : "This page can't be reached, This page took to long to respond, this page redirected too many times, this page can't be reached : TLS errors."

IF this was the malicious page protection the problem would be resolved by turning that protection off.

This is not the case, turn off and the problem is still there.

I rebooted, power cycled and have flashed all the alphas and beta, the issue is still there.

The only cure is to turn off AIProtection completely. As to the signatures they have not updated for 3 months, not after reboot, not after firmware upgrade and not after repeatedly clicking the check button.

Many people also report the issue where all reports suddenly stop. I was seeing blocked exploit events at a rate of 10 -20 a day , then suddenly nothing for 10 days .

Check the firewall log with AI turned off and not one of the "attacking" IP addresses is ever seen.

 

[Vexira]

I think you are misunderstanding the problem.

This is not a page being blocked as malicious, there is no TM blocking page/warning.

What happens is that sites fail to load and you get a variety of browser problems : "This page can't be reached, This page took to long to respond, this page redirected too many times, this page can't be reached : TLS errors."

IF this was the malicious page protection the problem would be resolved by turning that protection off.

This is not the case, turn off and the problem is still there.

I rebooted, power cycled and have flashed all the alphas and beta, the issue is still there.

The only cure is to turn off AIProtection completely. As to the signatures they have not updated for 3 months, not after reboot, not after firmware upgrade and not after repeatedly clicking the check button.

Many people also report the issue where all reports suddenly stop. I was seeing blocked exploit events at a rate of 10 -20 a day , then suddenly nothing for 10 days .

Check the firewall log with AI turned off and not one of the "attacking" IP addresses is ever seen.

That's strange my sign was updated recently I don't know if it's because I'm running an 88u

 

[bluepoint]

As to the signatures they have not updated for 3 months, not after reboot, not after firmware upgrade and not after repeatedly clicking the check button.

Signatures are being updated with mine. For a while the signature didn't auto update in the 378-382 branches but always works when manually sought. Sometime in the 384 branch, the auto update started to work again.

Rt-AC68P