[videoman87]

Post to DDWRT fourms with issue

-Router: Asus RT-N16
-DDWRT: dd-wrt.v24-14929 
(yeah I know it is old but it really works well with this router, and never had a problem with it (before now), but heard (and had) problems with some others awhile ago but forget the details now)
-Set up as a gateway

Ok this is a new one on me. A couple of days ago I started having internet disconnects. It would lose connection but the modem stats look really good (noise margin at 18 etc). In the past issues were always were with the line which noise went to 6 or below and poof.

But this time I realized things were different when I noticed the problems were from 7pm to 7am, it would disconnect every 2 minutes or so, reconnect then disconnect again 2 minutes later over and over again. Sometimes it would go 10 minutes but that was RARE. The rest of the time everything was rock solid.

The DSL modem has a pure bridge mode and I have DDWRT doing the PPPoE. The modem is on its own subnet 192.168.0.254

Taking the modem out of bridge mode and having it connect to the ISP directly I didn't have any disconnects during the 7pm-7am time (for almost a hour).

Well I finally got smart, put the modem back in bridge and turned on syslog in DDWRT and started checking the stats.

This is what I get when the disconnect happens:
Oct 4 22:20:43 192.168.x.1 user info kernel device vlan2 entered promiscuous mode
Oct 4 22:20:43 192.168.x.1 user info kernel device vlan2 left promiscuous mode
Oct 4 22:20:43 192.168.x.1 user info syslog pppd : PPP daemon successfully stopped
Oct 4 22:20:43 192.168.x.1 daemon info pppd\[940\] Exit.
Oct 4 22:20:43 192.168.x.1 daemon notice pppd\[1630\] pppd 2.4.4 started by root, uid 0
Oct 4 22:21:14 192.168.x.1 user info kernel device vlan2 entered promiscuous mode
Oct 4 22:21:14 192.168.x.1 user info kernel device vlan2 left promiscuous mode
Oct 4 22:21:14 192.168.x.1 user info syslog pppd : PPP daemon successfully stopped
Oct 4 22:21:15 192.168.x.1 user info syslog pppd : PPP daemon hanging, send SIGKILL
Oct 4 22:21:15 192.168.x.1 user info syslog pppd : PPP daemon successfully stopped
Oct 4 22:21:15 192.168.x.1 daemon notice pppd\[1680\] pppd 2.4.4 started by root, uid 0
Oct 4 22:21:15 192.168.x.1 daemon info pppd\[1680\] PPP session is 997
Oct 4 22:21:16 192.168.x.1 user info syslog vpn modules : vpn modules successfully unloaded
Oct 4 22:21:16 192.168.x.1 user info syslog vpn modules : nf\_conntrack\_proto_gre successfully loaded
Oct 4 22:21:16 192.168.x.1 user info syslog vpn modules : nf\_nat\_proto_gre successfully loaded
Oct 4 22:21:16 192.168.x.1 user info syslog vpn modules : nf\_conntrack\_pptp successfully loaded
Oct 4 22:21:16 192.168.x.1 user info syslog vpn modules : nf\_nat\_pptp successfully loaded
Oct 4 22:21:16 192.168.x.1 user info syslog process_monitor : Process Monitor successfully stopped
Oct 4 22:21:16 192.168.x.1 user info syslog process_monitor successfully started
Oct 4 22:21:22 192.168.x.1 user info syslog vpn modules : vpn modules successfully unloaded
Oct 4 22:21:22 192.168.x.1 user info syslog vpn modules : nf\_conntrack\_proto_gre successfully loaded
Oct 4 22:21:22 192.168.x.1 user info syslog vpn modules : nf\_nat\_proto_gre successfully loaded
Oct 4 22:21:22 192.168.x.1 user info syslog vpn modules : nf\_conntrack\_pptp successfully loaded
Oct 4 22:21:22 192.168.x.1 user info syslog vpn modules : nf\_nat\_pptp successfully loaded
Oct 4 22:21:22 192.168.x.1 daemon debug process_monitor\[1756\] We need to re-update after 3600 seconds
Oct 4 22:21:23 192.168.x.1 user info kernel IMQ driver unloaded successfully.
Oct 4 22:21:23 192.168.x.1 user info syslog wland : WLAN daemon successfully stopped
Oct 4 22:21:23 192.168.x.1 user info syslog vpn modules : vpn modules successfully unloaded
Oct 4 22:21:23 192.168.x.1 user info syslog vpn modules : nf\_conntrack\_proto_gre successfully loaded
Oct 4 22:21:23 192.168.x.1 user info syslog vpn modules : nf\_nat\_proto_gre successfully loaded
Oct 4 22:21:23 192.168.x.1 user info syslog vpn modules : nf\_conntrack\_pptp successfully loaded
Oct 4 22:21:23 192.168.x.1 user info syslog vpn modules : nf\_nat\_pptp successfully loaded
Oct 4 22:21:24 192.168.x.1 user info kernel IMQ starting with 2 devices...
Oct 4 22:21:24 192.168.x.1 user info kernel IMQ driver loaded successfully.
Oct 4 22:21:24 192.168.x.1 user info kernel Hooking IMQ before NAT on PREROUTING.
Oct 4 22:21:24 192.168.x.1 user info kernel Hooking IMQ after NAT on POSTROUTING.
Oct 4 22:21:25 192.168.x.1 user info syslog wland : WLAN daemon successfully started
Oct 4 22:21:25 192.168.x.1 user info syslog WAN is up. IP: xx.xx.xx.117
Oct 4 22:22:01 192.168.x.1 cron info cron\[20298\] (crontabs) ORPHAN (no passwd entry)

I do have two commands to allow for access to the modem GUI:
Startup:
ip addr add 192.168.0.253/24 dev vlan2 brd +

Firewall:
iptables -t nat -I POSTROUTING -o vlan2 -d 192.168.0.253/24 -j MASQUERADE

Under the Networking tab
Port setup
WAN Pot assignment: Vlan2
all the other settings on default

I have been running with this set up for years without a issue (DDWRT Mega). Anyone ever run into anything like this? It is also really strange the problem is only 7pm-7am and never had it before. I don't have any cron jobs or settings in there other than the daily reboot at 4am under the admin/keep alive tab

[tedm]

You have a cracker on the Internet who is targeting your router or targeting routers in your IP address block. Something they are throwing at that old version, some malformed packet of some kind, is causing the ppp daemon to crash and restart.

Your only 2 choices are to upgrade or just wait them out. Eventually, like a crazy ex girlfriend, they will give it up and leave to bother someone else.

[Alozaros]

yep build is too old...full of vulnerabilities and using old, not updated binaries...and yes if you use it as a edge router on WAN, you may be a victim/target and ect. best bet update reset and reconfigure...
also ... pppoe for WAN it could be the device in front of your router, that has a problems...or clearly ISP side...the logs shows normal pppoe behavior...i guess

[videoman87]

Well I did more testing and another time I used the modem alone as a router and it had the same problem. Then looking at connection logs, time was way off. Connecting to the NTP server wasn't working right for some reason. Then I looked and my DD-WRT time wasn't right either and was a hour off due to not having the right DST setting in. I doubt it was that but I changed it anyway.


Well it DID turn out to be the time settings. Right after I changed that, stable as a rock. My guess is my ISP has changed and when it is prime time, they look for more reasons to reduce traffic and if your time is off..... Although if that is the case it seems like it would be ADDing more traffic from all the relogs. But then again all these bots rarely do anything intelligent anymore lol.

Is there a way to get more details on the PPPoE connection than the syslog data?