jhgarrison
join:2004-07-04
Austin, TX
 ·RoadRunner Cable
| Netgear WGR614v7 changes its own IP address?
Anyone have an explanation for the following?
I help a friend (who is computer-clueless) with her office and home
wireless networks. I installed WGR614v7 routers in both places, and
configured them myself to use the default 192.168.1.0/24 LAN address
block. Today she called me and said she couldn't access the Internet
from any work computers. I went over and found that the router's LAN
IP had changed to 10.0.0.1, and since the office machines hadn't been
rebooted or ipconfig /repair'ed they couldn't talk to it.
I reset the router to factory defaults and reconfigured it from
scratch, changing the WPA passphrase and admin password to 14-
character random strings for good measure. I also double-checked the
remote-admin setting and confirmed that it is disabled.
I use the same configuration (SSID, admin PW and WPA passphrase) on
her home network so she isn't confused by multiple profiles when she
takes her laptop home. Given the changes on the work network it was
necessary to make the same security changes on the home router.
I walked her through the changes over the phone, and found that her
home router was ALSO reset to 10.0.0.1. We successfully completed the
password/passphrase changes but I had her leave the router at 10.0.0.1
so I can examine it later this week and check for other suspicious
changes.
Questions
Are there any known bugs that would cause a WGR614v7 to change the LAN
settings on its own?
Are there any known vulnerabilities that would expose the router to
remote hacks even with remote admin disabled?
Are there any known viruses that infect PCs whose primary purpose is
to mess with wireless routers? |
|
jhgarrison
join:2004-07-04
Austin, TX
·RoadRunner Cable
| The answer, from the Netgear support forums, is that the router will reconfigure itself to a new LAN netblock
if it detects a conflicting packet (i.e a script-kiddie
scanning for 192.168.1.x addresses) on the WAN interface.
The reason given for this behavior is that is transparently
handles things for clueless home users who try to attach it
to a DSL/Cable modem that already does NAT.
I would expect the provider to filter out unrouteable
addresses from the shared segment, but I guess AT&T
doesn't do this for their DSL customers. |
|
Timo_D
join:2002-10-22
Chicago, IL
| reply to jhgarrison
I would set the home and work IP's to use a different range of IP's. Otherwise I will bet that part of the confusion will be with her machine as it gets confused on where it needs to send its packets.
Set up work to be 192.168.1.0/24, and home to be something different like 192.168.2.0/24. You can use the same SSIDs etc but that way the laptop can tell that it needs to refresh its network settings. |
|
