[SOLVED] 10.112.112.112 gateway in my wireless router - what does it mean?
Linux - NetworkingThis forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
10.112.112.112 gateway in my wireless router - what does it mean?
Hi,
a wireless router (box) is went stuck, I found that when it is stuck it uses strange IP local address remote address 10.112.112.112, today is also went stuck but this time the gateway was 10.112.112.112. I had to switch off, switch on teh router to function properly. I am using DSL connection normally the gateway is likie that 78.8.... and my IP (dynamic) like 78.8.240.....
Is there any default meaning of 10.112.112.112 in teh net connections?
Please help, now I am afraid that my router is cracked.
AFAIK there is nothing special about the 112.112.112 part of 10.112.112.112 but 10.x.x.x is a private IP address range. Private IP addresses are not routed to the Internet so are not useful for anyone cracking your router over the Internet to get data from your computer.
If we are to answer your question we need more precise information about your wireless router. What is the make and model? When you write "normally the gateway is likie that 78.8.... and my IP (dynamic) like 78.8.240..." are those addresses on your computer or on the router? What is the output from the ifconfig command (when obscuring any public IP addresses, please leave the first and last octets visible, for example 78.x.x.1)
The router I am using is for home purposes its trade name is Pentagram, as I may guess it uses BusyBox so it seems it's Linux kernel based or *nix, if it will be of any help I will post a log file generated by the router. The wireless router is managed via web browser I have no idea how to connect to the router directly, so I am unable to use "ifconfig" command. The LAN range of addresses of the router is 192.168.1.100 - 192.168.1.200, eg. now I am working on a computer connected to the router and my IP is 192.168.1.101 , but the WAN IP of router which is delivered by a DSL connection operator is 78.... it is dynamic IP address it's depend on a particular connection. Last days I found that the WAN IP address was 10.112.112.112. which seems to be meaningless. Exactly with this WAN IP 10.112.112.112 the router was unable to connect with internet. Also the same address was set as a default WAN gateway.
@catkin
Exactly. The first time both IP and the gateway were set to 10.112.112.112. The second time the router IP was correct but the gateway was again 10.112.112.112.
@catkin
Exactly. The first time both IP and the gateway were set to 10.112.112.112. The second time the router IP was correct but the gateway was again 10.112.112.112.
Intriguing. The question focus is thus on why the router's WAN and gateway IP addresses are changing. It could be in response to an external event or spontaneously.
If spontaneously then it's broken.
If an external event then it could be over the LAN or over the WAN. It might be useful to know when the IPs changed; does the web interface of the router provide a log?
Externally initiated change should not be possible without a) admin via WAN interface being enabled and b) username+password. Sometimes admin via WAN interface is enabled via default. Sometimes the username+password are trivial, such as admin+admin; does the web interface allow these settings and, if so, how are they set now?
Some of these questions would be answered by the User Guide for your router. Do you know which Pentagram it is? The web interface may show hardware and firmware information. Is there anything written on the router itself, especially on the underside?
I didn't mentioned this earlier but in the time when this happened (changing the IP) the rtorrent was running - downloading/uploading torrents. When this happened all other computers in my home LAN were off.
The router doesn't allow external WAN connections via an option setting.
This a typical look of the router log.
Code:
Aug 20 04:32:06 (none) local0.info udhcpd[16010]: udhcpd (v0.9.9-pre) started
Aug 20 04:32:06 (none) local0.err udhcpd[16010]: max_leases value (254) not sane, setting to 100 instead
Aug 20 04:32:06 (none) local0.err udhcpd[16010]: Unable to open /var/lib/misc/udhcpd.leases for reading
Aug 20 04:32:06 (none) local0.info udhcpd[16015]: Received a SIGTERM
Aug 20 04:32:06 (none) local0.info udhcpd[16025]: udhcpd (v0.9.9-pre) started
Aug 20 04:32:07 (none) local0.err udhcpd[16025]: max_leases value (254) not sane, setting to 100 instead
Aug 20 04:32:07 (none) daemon.info dnsmasq[16043]: started, version 2.40 cachesize 150
Aug 20 04:32:07 (none) daemon.info dnsmasq[16043]: compile time options: no-IPv6 GNU-getopt no-RTC no-ISC-leasefile no-DBus no-I18N TFTP
Aug 20 04:32:07 (none) daemon.info dnsmasq[16043]: reading /etc/resolv.conf
Aug 20 04:32:07 (none) daemon.info dnsmasq[16043]: using nameserver 217.30.137.200#53
Aug 20 04:32:07 (none) daemon.info dnsmasq[16043]: read /etc/hosts - 2 addresses
Aug 20 04:32:09 (none) daemon.info pppd[458]: PPP session is 7427
Aug 20 04:32:09 (none) daemon.notice pppd[458]: Connect: ppp0 <--> eth0.2
Aug 20 04:32:10 (none) daemon.info pppd[458]: CHAP authentication succeeded: CHAP authentication success, unit 2168
Aug 20 04:32:10 (none) daemon.notice pppd[458]: peer from calling number 00:30:88:02:81:0F authorized
Aug 20 04:32:10 (none) daemon.warn pppd[458]: Local IP address changed to 78.8.1.77
Aug 20 04:32:10 (none) daemon.warn pppd[458]: Remote IP address changed to 78.8.1.1
Aug 20 04:32:10 (none) local0.info udhcpd[16033]: Received a SIGTERM
Aug 20 04:32:11 (none) daemon.info dnsmasq[16043]: exiting on receipt of SIGTERM
Aug 20 04:32:11 (none) local0.info udhcpd[16099]: udhcpd (v0.9.9-pre) started
These are firewall settings
Code:
Enable Firewall? Yes
Enable DoS protection? No
Enable Web Access from WAN? No
Port of Web Access from WAN: 8080
Respond Ping Request from WAN? No
VPN passthrough
IP security VPN passthrough Yes
PPTP VPN passthrough Yes
L2TP VPN passthrough Yes
The exact name of the router is CERBERUS P 6381-3 (made by Pentagram)
Good info -- a) only the router and your computer active and b) running rtorrent. Plus the router provides a more informative log than many.
No web access from WAN but that leaves other possibilities including telnet and ssh. Might be worth changing any administrative password from the default value.
I can't see anything alarming in the log but the SIGTERMs are curious. It would be nice to see a sample log from a normally functioning router for comparison.
It would also be nice to see a log covering the time when the IP address(es) change.
I don't have any idea why the problems have happened yet, still gathering information hoping it will suggest something.
Is the problem solved? Have you found out why the IP addresses changed? Have you done something that will stop them changing again? If so, please share the solution with us and mark the thread SOLVED (via the Thread Tools menu).
No I have no idea why this happened. The possible solutions: to change a router, I have a spare Linksys, but I have problems with an installation. If the same will happens with this new router at least I will know that it is not the router I am using now responsible. Or to try to crack the router and in this way get some information. I think it may be difficult but possible. I am also curious about those SIGTERM's in logs.
Hi,
the same happened. This is the status information
Code:
Connection type : PPPoE
WAN IP : 78.8.156.76
Subnet Mask: 255.255.255.255
Gateway : 78.8.156.1
DNS Servers: DNS1 217.30.137.200 ; DNS2 217.30.129.149
WAN port link status : Link up
The log when the IP changed contains no information. But after I restarted the router I get a new log with this preamble
Code:
Jan 1 00:00:21 (none) syslog.info syslogd started: BusyBox v1.00-pre10 (2009.06.22-08:08+0000)
Jan 1 00:00:21 (none) cron.notice crond[241]: crond 2.3.2 dillon, started, log level 8
Jan 1 00:00:29 (none) daemon.info pppd[458]: Plugin /etc/ppp/plugins/rp-pppoe.so loaded.
Jan 1 00:00:29 (none) daemon.info pppd[458]: RP-PPPoE plugin version 3.3 compiled against pppd 2.4.2
Jan 1 00:00:29 (none) daemon.notice pppd[458]: pppd 2.4.2 started by root, uid 0
Jan 1 00:00:29 (none) daemon.info pppd[458]: Using interface ppp0
Jan 1 00:00:30 (none) daemon.notice pppd[458]: local IP address 10.64.64.64
Jan 1 00:00:30 (none) daemon.notice pppd[458]: remote IP address 10.112.112.112
Jan 1 00:00:33 (none) daemon.info pppd[458]: Starting link
Jan 1 01:00:37 (none) local0.info udhcpd[636]: udhcpd (v0.9.9-pre) started
Jan 1 01:00:37 (none) local0.err udhcpd[636]: max_leases value (254) not sane, setting to 100 instead
Jan 1 01:00:39 (none) daemon.info dnsmasq[681]: started, version 2.40 cachesize 150
Jan 1 01:00:39 (none) daemon.info dnsmasq[681]: compile time options: no-IPv6 GNU-getopt no-RTC no-ISC-leasefile no-DBus no-I18N TFTP
Jan 1 01:00:39 (none) daemon.info dnsmasq[681]: reading /etc/resolv.conf
Jan 1 01:00:39 (none) daemon.info dnsmasq[681]: using nameserver 217.30.137.200#53
Jan 1 01:00:39 (none) daemon.info dnsmasq[681]: read /etc/hosts - 2 addresses
Jan 1 01:01:00 (none) daemon.info pppd[458]: PPP session is 5692
Jan 1 01:01:00 (none) daemon.notice pppd[458]: Connect: ppp0 <--> eth0.2
Jan 1 01:01:01 (none) daemon.info pppd[458]: CHAP authentication succeeded: CHAP authentication success, unit 7575
Jan 1 01:01:01 (none) daemon.notice pppd[458]: peer from calling number 00:30:88:02:81:0F authorized
Jan 1 01:01:01 (none) daemon.warn pppd[458]: Local IP address changed to 78.8.242.211
Jan 1 01:01:01 (none) daemon.warn pppd[458]: Remote IP address changed to 78.8.242.1
I found the software provider. It seems that it is the GoAhead WebServer. Should I contact with the provider?
Last edited by igadoter; 09-05-2010 at 01:24 PM.
Reason: addons
Sorry, I do not know enough about PPPOE to help further.
You could start a new thread mentioning PPPOE and Pentagram CERBERUS P 6381-3 in the title, summarising the information given here, giving a link to this thread.
I contacted with a manufacturer of the router. I obtained an update of a firmware. So, I will see. But they also said nothing about what may caused such behavior. Now I doubt that the firmware really has something with Goahead Webserver. Even if Pentagram uses logo very 'similar' to the Goahead one. Simple I don't belive that Goahead wich serves for Lockheed and other big companies in the same time creates firmware for Pentgram's small home routers.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
