Public IP is the same as my router login IP

Started by pkoko3, February 02, 2023, 06:32:32 PM

Previous topic - Next topic

pkoko3

My default gateway address used to be 192.63.48.1. However, recently when I typed that into the address bar, I was redirected to a different address to log into my router with. This new router address is now also my public IP address.
Also, when I log into this (new) router address, it shows my IPv6 starting with 2605:6000:9fc0:007b:xxxx:xxxx:xxxx:xxxx: However when I check my computer's network settings, 2603:8080:a00:4035:xxxx:xxxx:xxxx:xxxx is shown as my IPv6. 
What (if anything) does this indicate? 
PS: Please be patient with my lack of knowledge here. I know very little about networking and am trying to sort out an ongoing issue. I really appreciate any help you can provide. Thank you!

deanwebb

It is possible to have multiple IPv6 addresses for a given host. There can be different contexts for the addresses, hence the differences in the prefixes.

Having the public IPv4 address the same as the login address makes me uneasy, as it stands to reason that anyone can attempt the login, not just you. Now, if it refused logins from everywhere except the ISP management network and your home network, I'd feel somewhat better, but not entirely so.
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

pkoko3

First, thank you so much for taking the time to reply and help me! Second, yes the router login is available from anywhere, any device, any ISP. I have changed routers multiple times and within weeks it's the same cycle every time- my router login address changes, which then matches my public IP address, and my ISP says my IP should be something totally different. What are the possible contexts/reasons for the different IPv6 prefixes? It probably helps to know that my network and devices are compromised by an ex, hence my efforts to "unhack" myself. Thank you again for any help you can provide.

deanwebb

The prefixes come from the folks running the network, so questions on what they mean would have to go to them. They likely have a system that makes some sense to them, so it's what they use, even when it stops making sense. :D

Now, if the ISP says your router IP should be different, *that* is a trouble ticket with the ISP as to why your IP address is the way it is.
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

Dieselboy

Usually you can access the router admin page and log in and turn off remote login while keeping the login accessible to yourself. If you log in and take a look around then most settings can be worked out. You'll be looking for something along the lines of security > management or admin interface.

To do this, try logging in not through the public IP but into the private IP, as this is the address you should be using while only at home. I assume you have windows so press start and load the terminal interface by typing cmd.exe. it's a black window that looks like dos. Now type "ipconfig /all" without the quotations and scroll down to the IP address that's listed as "default gateway ". There should only be one. Now you can copy/paste or manually type that into your web browser and log in. In most cases this is how the login works.

Private IP addresses have ranges. You don't find these on the internet. The internet should drop data coming from or going to these addresses because the internet only routes public IP blocks.
Private addresses are in these ranges:
10.x x x
172.(16-31).x.x
192.168.x.x

You only really want web management turned on and if it gives you the option for http or https then you should be fine to leave only https enabled. If there are other options like telnet or ash being shown then you should be fine to keep them off.

You'll want to find the option for management via wan or internet or something which explains being outside and allowing access to the management or admin and turn that off.

If it doesn't have that but instead has a rule that wants to have an ip address to allow management then it might be showing an allow address of 0.0.0.0. let us know and we'll help with that so you can keep access and restrict everything else.

You probably want to change your wifi password as well as set a secure admin password.

You should be using a password manager so that all passwords are unique to everything you need to log in to.

I would suspect that, if someone can access then it's via the computer, unless it's a laptop that's usually off unless you're using it. I would check there is no software on there that shouldn't be, such as TeamViewer or something allowing remote access. These sorts of services always maintain an active connection to a cloud service so they can accept remote connections any time. So nothing needs to be done to your router to make them work.

There is a native service that comes with windows that is off by default that allows remote connections and login. But to access this from the internet would need an allow rule created in your router as well as the IP of your router to target in their app to initiate the connection.

If you suspect any loss of privacy at all then I would systematically and methodically change every password for every system, app, service that you access and keep all of these logins saved securely so you can access them but no one else can. 


Dieselboy

Quote from: pkoko3 on February 02, 2023, 06:32:32 PM
My default gateway address used to be 192.63.48.1. However, recently when I typed that into the address bar, I was redirected to a different address to log into my router with. This new router address is now also my public IP address.
Also, when I log into this (new) router address, it shows my IPv6 starting with 2605:6000:9fc0:007b:xxxx:xxxx:xxxx:xxxx: However when I check my computer's network settings, 2603:8080:a00:4035:xxxx:xxxx:xxxx:xxxx is shown as my IPv6. 
What (if anything) does this indicate? 
PS: Please be patient with my lack of knowledge here. I know very little about networking and am trying to sort out an ongoing issue. I really appreciate any help you can provide. Thank you!

Routers work by routing between different networks. A network is signified by a network address and a mask which defines a range of addresses. The mask is a /x where X is a number. A router can only route between different networks. So the two ipv6 addresses you posted are maybe of your inside (private) and your public addresses.  I just ignore the IPv6 in most cases because it's not in high use here.
But some routers may have separate allow/deny rules for management for ipv4 and IPv6 so worth keeping a look out

pkoko3

#6
Thank you so much for all of that information. Could you help me with a few workarounds please? Here are the issues..

I cannot access a private IP anymore. I used to be able to. And then one day I was automatically redirected to this new public IP for router log in. I was redirected for months and eventually gave up and started going directly to the new IP to log into my router. Now when I try to access my default gateway or local address, the server times out and never connects. I don't know if this is helpful or not but /ui/1.0.99.208179/dynamic/home.html is automatically added to the end of my IP when I type it into the address bar.

I have a windows computer but am using Ubuntu Linux via USB in order to access the internet. I was forced to do this because my "access is denied" to anything internet or network related in Windows. In Ubuntu when I try to do anything admin related, I'm also restricted and denied access. For reference, this computer was purchased by me and has only been owned by me. Is there a way to undo these restrictions? 

I've contacted my ISP numerous times and they never have an answer as to what is causing the IP and numerous prefix changes. And the only solution they offer is sending me a new router. I do this and within a week or so, I'm back to the same issues. I've changed every password. I switched out the hard drive on my computer. I don't know what I'm missing that is leaving unauthorized access. 

Dieselboy

#7
Seems a bit odd.

Ubuntu works a bit different, usually you want to install Ubuntu rather than run it from the live usb and I'm not sure if the live cd is being restrictive.

How the internet works for the most part is you type the address the address bar like google.com and then a few things happen:
- the computer will look up google.com and find an ip address
- then the computer tries to make a connection to the IP address and download the web content.
It makes the connection by looking at the address and relating that it's not on your local network (eg the inside of your router) so  it then knows it needs to send this request to your default gateway to route the traffic on from there. The computer doesn't care too much once it's sent the data to your router.

If the web page comes back as denied, it would be helpful to see this screenshot, such as what the address in the web browser is saying and the layout of the page showing the denied message. Often the message will be specifically formatted a certain way and it may help then identify what sort of device is sending the response.

For there to be a denied message, sometimes needs to intercept that connection request and instead of routing to google, return the error / access denied page instead. This interception can be done either transparently (eg, the router in the path of the traffic replies) or by a proxy configuration on the computer where this proxy server is configured to forward traffic there.

The lookup of google.com to ip address is a mechanism called DNS. Often, the router that the ISP sends out still have DNS server IP address of the router itself. The router will act like a DNS server but usually just relay these lookups to the ISP DNS se server. When we set up networks from the ground up, we will plug our laptops directly into the internet line to check that the internet is actually working. We can run pings to IP addresses that confirms routing is working but to load web pages, we need to resolve the domain names like google.com to up address. So we memorise some DNS servers that we can put in on the laptop to make that work.

So you don't need to use the router or ISP DNS servers. You can use free opendns or Google's DNS servers instead. I always do this at home after my isp had an issue with their DNS servers back in around 2007 when I was a junior. It seemed like my internet was down. It wasn't down, only the ISP DNS servers were.

You can see which DNS servers your windows computer is using by  opening the CMD.exe and typing "ipconfig /all". It may only show one IP and the up IP is the same as the default gateway IP. This would indicate the router is handling that.

You can change your DNS servers in 2 ways, either get the router to issue out the opendns server address for example or make this change on your windows computer itself. On Ubuntu I can't remember exactly how to do this.
On windows you need to go into the network adaptor settings and open the box that lets you set a IP address. You want to leave everything alone except DNS server address. This might be quicker and easier to do compared with changing it on the router.

On Ubuntu, I can't remember exactly but Ubuntu is Linux and everything in linux is done by writing text files. So the DNS IP addresses you're using will be in a text file somewhere. I say somewhere because Ubuntu likes to be a little bit different to most other Linux when it comes to setting the IP address and DNS addresses. But I think you may be able to do this to at least see what you're using and if it's the same as the gateway/router.

Open the Linux equivalent of CMD.exe which is often called simply "terminal". It will be a text window that looks like dos again. In there the language is different to windows so you can show your ip address by using "ifconfig" instead of the windows "ipconfig /all". But I don't think this will show your default gateway or DNS servers.
To show your DNS servers I think you can just show the contents of the DNS file. You do this by typing "cat /etc/resolv.conf". The file is at /etc/resolv.conf and "cat" just means to read and show the contents to the terminal. I think though you may not get up addresses shown there.

So can I ask,.if you join a tablet or phone to your wifi does it work fine or do you get the same problems?

Often you can just buy a home office router and swap it in place of the one the internet provider sent you. But you do need to consider how the ISP is providing you the internet because you'll need to set a new router up the same way, when you own it completely yourself. I often avoid using routers from the ISP because they're usually the low end cheap ones, and here in Australia they charge us for them anyway. But back in UK they're free but still the cheap kind.




IP addresses that your router will obtain from the ISP, to use on the outside (the link between your router and the ISP, not the inside that is your home network or wifi) will change randomly. It's rare to have a residential connection that does not change IP addresses on the outside.
It sounds like your router is keeping track of this so if you try and access an old, no longer used IP to access the admin interface, then it's sending you too the right place. I have seen this before myself with routers made by Thomson (Chinese company, name or ownership did used to change a lot but a lot of ISPs use this brand and they're cheap but mostly ok).
But accessing on the inside IP should be working for you.

Try these things too:
All Thomson routers, regardless of IP addresses used on the wifi, always keep another ip that can be used to access the management interface. You can't see this IP configured but if.you try to access it then it will reply and load the management interface. This only works for the Thomson routers though and so if this works or not is no indication of an issue either way. See if you can type http://10.0.0.138 in your web browser and get to the management page of your router. Worst case, you'll just get a page times out message.

The other thing to try is check your IP and gateway on the Ubuntu computer:
First type "ifconfig" to see your IP address. There might be more than one though on Ubuntu for different reasons.
The other thing to do is to show your Gateway IP by typing "route -n" or if not then just type "route" and press enter. You should see a table of IP addresses shown an and there will be one that shows something like:
0.0.0.0.............192.168.1.1

That line is the default gateway. It says traffic to any destination network (the 0.0.0.0 address), send it to 192.168.1.1 where this IP might be different but it should be your router. You should then be able to type that router IP into a web browser and load up the admin page of the browser.

Virus or malware can also act like this on windows. But generally live CD load from a fresh each time you start it up and you can't really customise things like a desktop background until you actually install Ubuntu to the hard drive, but USBs are both read/write (cd's are read only) so this might not be true in all cases these days.

I'd be keeping all nonessential computer things unplugged from the modem or disconnected from wifi or even powdered off until you can understand more about why you're getting weird experiences. It could be something as simple as an update from the ISP that's not been done correctly and is disconnecting you or denying you from then internet, maybe it's the DNS issue that I had. But it could also possibly be something else, such as the router being compromised or even your smart TV or something like that (my friend has a Samsung fridge freezer with what looks like a tablet screen on the front of it).

This web address /ui/1.0.99.208179/dynamic/home.html looks like /UI/ loads the web server and the number could be the software version number that the router is using. It looks normal and not concerning. Things like that will show in the address bar when you navigate around web sites.

Any questions or help please post back.

There's likely typos in my post from predictive text as I'm on a minute phone.