Duff router or duff software firewall?

A customer for whom I installed a Netgear DG834G(UK) router on AOL a few
weeks ago is reporting that he can no longer access the internet. Up until
then, everything was working fine.

I want to check the symptoms in advance of going to see him on Thursday to
make sure I've come to the correct conclusion based on the tests that I've
got him to perform over the phone:

- wired PC cannot access external web pages: it hangs while requesting any
page (I suspect if I left it long enough it would time out)

- PC also cannot browse to router's config page by IP address: instead of
bringing up the router's login prompt, the browser again hangs

- I can ping the router

- I can ping an external site by IP but not by domain name (eg
news.bbc.co.uk): in the latter case, ping times out without even displaying
the "pinging <IP>" message, let alone the "reply from ..." messages

- PC cannot browse to a web site even by its IP address

- ipconfig /all on the PC shows that the IP address is in the router's
subnet, that the subnet mask is correct (255.255.255.0) and that the DHCP
and DNS servers are correctly set to the IP of the router.


It looks as if the router is failing to do DNS lookups, since I can ping by
IP but not domain name. The router is working to the extent that it will
allow me to ping external addresses, so the ADSL modem and the broadband
connection to the internet is working OK.

However I'm at a loss to explain why I can't browse to the router's config
page. That almost suggests that the PC's firewall (McAfee) is blocking
traffic all of a sudden. The customer has tried disabling McAfee's firewall,
but to no avail.

I've powered-off and rebooted both the PC and the router.


When I go to see him, one of the first tests I'll perform is to try
accessing the router from my own PC. This will also allow me to check a
*probably* unrelated symptom that a wireless PC can no longer connect to the
router. I say "probably" because the chances of two separate faults (lack of
web browsing even on wired connection and lack of wireless conenction) which
have both begun at the same time is remote.


Any other things I should try when I visit the customer. I'm taking my own
router to check for simple hardware failure.

sounds like DNS. i'd try manually setting an IP, subnet, gateway and
DNS address on a client, and checking that works. start with the ISP's
DNS address, and if that doesn't work, try another ISPs. if it does
work, check that the router has picked up the correct DNS for the ISP -
perhaps it's changed recently?
i've had a netgear of that type where I couldn't access it periodically
from the web interface: didn't get to the bottom of it. there are
updated firmwares for most though, worth trying after a hard reset.
also, as it's AOL, MTU should be set to 1400 I think...

"Martin Underwood" <(E-Mail Removed)> wrote in message
news:441e3bb9$0$6952$(E-Mail Removed)...
: - wired PC cannot access external web pages: it hangs :
: - PC also cannot browse to router's config page by IP address:

Guessing that the router / gateway is 192.168.0.1 here
This would suggest that either the router is not responding to
requests or not getting them so does not help as to PC or Router

: - I can ping an external site by IP but not by domain name

This would then suggest that the PC can see the gateway and net so
makes little sense

: - ipconfig /all on the PC shows that the IP address is in the
router's
: subnet, that the subnet mask is correct (255.255.255.0) and that the
DHCP
: and DNS servers are correctly set to the IP of the router.

: - PC cannot browse to a web site even by its IP address

A couple of things spring to mind. First of all I've gotten through
six DG834G's in under 2 years. Maybe I am unlucky or maybe they are a
sack of crap.
That said a recent McAfee update was floored and managed to wrongly
identify loads of microsoft files as 'viruses'. They sorted it inside
of 4 hours but it's done alot of damage mostly to the office suite.

You 'client' has not attempted a firmware upgrade that has gone tits
up is he???

My first test would be to check the connection with a known good
modem.
I would then check the router can see the BT Test Login and test page.
I would set a static IP for the PC and enter the DNS and gateway
myself.
It could be that McAfees have a trusted zone (say 192.168.0.0 - 100)
and the DHCP has leased the machine 101 or some other figure out of
range of the firewall. (long shot) crude pings work ok but traffic to
specific ports are blocked.

In all honesty it could be anything. I would want to establish quickly
what it was NOT in this instance as it could come down to a number of
things.
Take a modem/router and pc of your own to test it all is the best
advice. I has 3 DG834G's that failed giving intermittent loss of
traffic on wired connections. 3 With wireless issues and all of them
have had shabby RJ45's with poor connections on the sockets after a
few in/outs. Also the line noise figures and other useful data
(logging date/time) is utter shite with them and In fact I will never
buy another one. I routeenly use the Linksys WAG354G for all new home
and small business jobs I do now as I don't have to go back to them.
I've always hated the bloke that recommended Netgear to me - they have
been a bain in my life.

Good luck!

Sucuba Dude wrote in message
dvmmkj$mi3$(E-Mail Removed):

> "Martin Underwood" <(E-Mail Removed)> wrote in message
> news:441e3bb9$0$6952$(E-Mail Removed)...
>> - wired PC cannot access external web pages: it hangs :
>> - PC also cannot browse to router's config page by IP address:
>
> Guessing that the router / gateway is 192.168.0.1 here
> This would suggest that either the router is not responding to
> requests or not getting them so does not help as to PC or Router
>
>> - I can ping an external site by IP but not by domain name
>
> This would then suggest that the PC can see the gateway and net so
> makes little sense

Yes, I was fully expecting that test to fail and was a bit perplexed when it
worked.

>> - ipconfig /all on the PC shows that the IP address is in the
>> router's subnet, that the subnet mask is correct (255.255.255.0) and
>> that the DHCP and DNS servers are correctly set to the IP of the
>> router.
>
>> - PC cannot browse to a web site even by its IP address
>
> A couple of things spring to mind. First of all I've gotten through
> six DG834G's in under 2 years. Maybe I am unlucky or maybe they are a
> sack of crap.
> That said a recent McAfee update was floored and managed to wrongly
> identify loads of microsoft files as 'viruses'. They sorted it inside
> of 4 hours but it's done alot of damage mostly to the office suite.
>
> You 'client' has not attempted a firmware upgrade that has gone tits
> up is he???

To the best of my knowledge, no (he wouldn't know how) but I might ask that
question explicitly ;-)


> My first test would be to check the connection with a known good
> modem.
> I would then check the router can see the BT Test Login and test page.
> I would set a static IP for the PC and enter the DNS and gateway
> myself.
> It could be that McAfees have a trusted zone (say 192.168.0.0 - 100)
> and the DHCP has leased the machine 101 or some other figure out of
> range of the firewall. (long shot) crude pings work ok but traffic to
> specific ports are blocked.

My gut feeling is that it's McAfee blocking HTTP port 80 - that would
explain why even attempts to access the router's web config page on
192.168.0.1 are being blocked. By why should it only just have started doing
this. The customer did say that McAfee isn't recognising that he's bought
another year's subscription and is still nagging him to renew.

I'll check the range of the trusted zone, although the customer did say that
ipconfig was showing that the PC had 192.168.0.2.

If there hadn't been the wireless problem, I'd have got him to repeat the
tests from the other PC and to try PC-to-PC comms (eg printer sharing).

I'll try a static IP, DNS etc to see if it makes any difference.


> In all honesty it could be anything. I would want to establish quickly
> what it was NOT in this instance as it could come down to a number of
> things.
> Take a modem/router and pc of your own to test it all is the best
> advice. I has 3 DG834G's that failed giving intermittent loss of
> traffic on wired connections. 3 With wireless issues and all of them
> have had shabby RJ45's with poor connections on the sockets after a
> few in/outs. Also the line noise figures and other useful data
> (logging date/time) is utter shite with them and In fact I will never
> buy another one. I routeenly use the Linksys WAG354G for all new home
> and small business jobs I do now as I don't have to go back to them.
> I've always hated the bloke that recommended Netgear to me - they have
> been a bain in my life.

I've always found them to work very well: my own DG834GT has been in use
every day for about a year and the only times I've had problems have been
due to BT or my ISP doing maintenance work.

I've probably installed about 30 over the year and this is the only customer
who's reported a fault.


THe thing that *has* caused me endless problems is the Netgear WG111 USB
wireless adaptor: both my own and a customer's (which he bought before he
first called me) have a habit of causing the PC to lock solid (no mouse,
keyboard or sound card response) every so often for no apparent reason. I
certainly wouldn't recommend one to my worst enemy: the only reason I got
one was because there was a special offer on the router at the time I bought
it so a USB adaptor was included for the same price.

"Martin Underwood" <a@b> wrote in message
news:441ee722$0$70281$(E-Mail Removed)...
: Sucuba Dude wrote in message
: dvmmkj$mi3$(E-Mail Removed):
: THe thing that *has* caused me endless problems is the Netgear WG111
USB
: wireless adaptor: both my own and a customer's (which he bought
before he
: first called me) have a habit of causing the PC to lock solid

Oh yes....

I saw a small smart car today covered in Netgear logos outside a large
computer company.
What made me piss my pants was the RAC man with the bonnet up trying
to get it to start. I wish I had my camera at the time.

Some people swear by them. Some don't. It's whatever floats your boat!

Do post what you found for the fix. I wonder if mcA has some 'you will
renew' code in it that blocks access to the web to panic customers? I
wonder if he has got the rouge update. I wonder if he has a virus
because it expired. Can he get the McA renewal site through it or does
that bomb out too???

"Martin Underwood" <(E-Mail Removed)> wrote in message
news:441e3bb9$0$6952$(E-Mail Removed)...
>A customer for whom I installed a Netgear DG834G(UK) router on AOL a few
> weeks ago is reporting that he can no longer access the internet. Up until
> then, everything was working fine.
>
> I want to check the symptoms in advance of going to see him on Thursday to
> make sure I've come to the correct conclusion based on the tests that I've
> got him to perform over the phone:
>

Christ! I hope he doesn't read this group thinking he is employing some
sort of expert!
That's terrible that you don't know how equipment you supply/install works -
or even what to advise when you ask him to do tests. Give your customer my
number and I will go and fix it for him, but I do charge!

simon wrote:
> That's terrible that you don't know how equipment you supply/install works

Don't be so hasty. There are plenty out there selling stuff that they
know little about. I have come accross 'experts' who have been unable to
even log into the admin on a router they have sold as 'one of the best
you can get'. This guy is at least putting in the time and effort to
sort out what is either customer stupidity or a fucked router. That's
pretty decent. If it is the former I would charge, the latter I would
deal with by warranty.

-
> Give your customer my number and I will go and fix it for him, but I do charge!

Toughting for work in newsgroups is a form of prostitution. Attacking
others to try and get work is the lowest of the low and normally throws
more shadows on your abilities that that of the OP.

If your such an expert offer the guy some advice or fuck off!

Daniel Richards wrote in
swFTf.124268$(E-Mail Removed):

> simon wrote:
>> That's terrible that you don't know how equipment you supply/install
>> works
>
> Don't be so hasty. There are plenty out there selling stuff that they
> know little about. I have come accross 'experts' who have been unable
> to even log into the admin on a router they have sold as 'one of the
> best you can get'. This guy is at least putting in the time and
> effort to sort out what is either customer stupidity or a fucked
> router. That's pretty decent. If it is the former I would charge, the
> latter I would deal with by warranty.
>
> -
>> Give your customer my number and I will go and fix it for him, but I
>> do charge!
>
> Toughting for work in newsgroups is a form of prostitution. Attacking
> others to try and get work is the lowest of the low and normally
> throws more shadows on your abilities that that of the OP.
>
> If your such an expert offer the guy some advice or fuck off!

Thanks for your support Daniel.

I asked my question in this newsgroup as a form of peer review, in just the
same way as colleagues who worked in the same business might compare notes
on a tricky case to make sure that nothing had been missed. Just because I
ask doesn't mean that I'm incompetent - though I'm always willing to learn
more if there's something I've genuinely missed!

I spent about half an hour on the phone to the customer on Saturday evening,
at my expense (I was responding to a message that he left earlier in the
day), getting him to perform a number of tests to determine what worked and
what didn't, so as to help me locate the cause, in case it turned out to be
something for which there was a quick fix.

There's a limit to what tests can be performed at a distance. I'm itching to
try my own laptop on his network (both wired and wireless) to eliminate the
effect of his McAfee, and my own router to eliminate problems with his one.
But neither of these can be done till I get there.

What additional tests would Simon have asked the customer to perform and
what conclusions would he have drawn? What additional tests would he perform
once he was on site? Be specific, Simon - rather than just saying how
terrible it is that I don't know how equipment that I install works.

On 21 Mar 2006 10:35, "Martin Underwood" <(E-Mail Removed)> wrote:

>There's a limit to what tests can be performed at a distance.

Especially as he's on AOL with different MTU setting, and when I
helped a neighbour, the PPP "chatter" provided him with a single
DNS, rather than primary and secondary which most ISPs do. Whole
load of things which could cause problems, compared with 99 % of
ISPs with similar settings, and using "standard" BT service.

NoNeedToKnow wrote in
(E-Mail Removed):

> On 21 Mar 2006 10:35, "Martin Underwood" <(E-Mail Removed)> wrote:
>
>> There's a limit to what tests can be performed at a distance.
>
> Especially as he's on AOL with different MTU setting, and when I
> helped a neighbour, the PPP "chatter" provided him with a single
> DNS, rather than primary and secondary which most ISPs do. Whole
> load of things which could cause problems, compared with 99 % of
> ISPs with similar settings, and using "standard" BT service.

I never noticed that AOL only gives one DNS server entry, but then I was
looking more for the fact that when the router had connected, it had been
allocated a sensible AOL-specific IP address.

I know all about the MTU setting which needs to be changed from the default
of 1458 to 1400. I'm still not sure how essential that is: when I was
setting up one router on AOL for another customer, I initially forgot about
changing the MTU, and it connected fine. Whether it would have remained
connected once I started transferring large amounts of data is another
matter - I didn't try it because I corrected the MTU as soon as I realised.
However for another AOL/Netgear router customer it refused to connect (I
think it failed to even attempt CHAP authentication) when MTU was 1458. So
it looks as if the same equipment (DG834) to the same ISP (AOL) can give
different results - maybe depending on line condition and precise equipment
at the exchange.

In the case of my present customer, it looks as if the router is esablishing
a connection to the internet, in that I can ping a remote site
(news.bbc.co.uk) by its IP address. If only I could see the router's config
page I could confirm that it's being given sensible IP and DNS addresses.
Inability for a PC to access the router's config page over Ethernet is weird
when it can ping the router's IP - sounds like a firewall port 80 problem.
If the customer had been using Outlook Express rather than AOL to read his
email, it would have been intereting to see if POP and SMTP traffic was also
failing to get through. Hence the need to test with my PC, whose Norton
firewall definitely allows 192.168.0.x:80 traffic through.

All will no doubt become clear(er) on Thursday when I go to see the
customer.

I suspect I'll be doing battle with McAfee's firewall - oh, goody ;-)