Skip to content
GaelMartinez's profile

Contributor

 • 

21 Messages

Tue, Dec 24, 2019 10:00 PM

transparent dns proxying started after a modem swap ...

Today my gateway was replaced with a 

 
Model:CGA4131COM
Vendor:Technicolor
Hardware Revision:2.1
 
running the following firmware...
 
eMTA & DOCSIS Software Version:CM DOCSIS Application - Prod_17.20_d31 & MTA Application - Prod_17.2
Software Image Name:CGA4131COM_3.1p24s1_PROD_sey
Advanced Services:CGA4131COM
Packet Cable:2.0
 
I have static ips and run a dns server slave and mail server, the dns zones stopped downloading right after the swap... looking at the errors, the SOA of my zones were incorrect...
When trying the following tests, I was surprised to see that any random ip could be used as a dns server and was responding to dns queries implying that some kind of transparent dns proxy was occuring... 
 
root@infra:/etc/bind# nslookup www.comcast.com 1.2.3.4
Server:         1.2.3.4
Address:        1.2.3.4#53

Non-authoritative answer:
www.comcast.com canonical name = www.comcast.com.edgekey.net.
www.comcast.com.edgekey.net     canonical name = e523.dscb.akamaiedge.net.
Name:   e523.dscb.akamaiedge.net
Address: 23.45.1.143

root@infra:/etc/bind# nslookup www.comcast.com 4.5.6.7
Server:         4.5.6.7
Address:        4.5.6.7#53

Non-authoritative answer:
www.comcast.com canonical name = www.comcast.com.edgekey.net.
www.comcast.com.edgekey.net     canonical name = e523.dscb.akamaiedge.net.
Name:   e523.dscb.akamaiedge.net
Address: 23.45.1.143

root@infra:/etc/bind# nslookup www.comcast.com 9.8.7.6
Server:         9.8.7.6
Address:        9.8.7.6#53

Non-authoritative answer:
www.comcast.com canonical name = www.comcast.com.edgekey.net.
www.comcast.com.edgekey.net     canonical name = e523.dscb.akamaiedge.net.
Name:   e523.dscb.akamaiedge.net
Address: 23.45.1.143
As it was not happening before, I'm assuming that it is a weird behavior from the gateway... it is configured in pass thru, firewall is disabled, wan dhcp is disabled, all rules are off... Is that a bug ? Am I missing some obvious button to disable that dreadful transparent proxying ?
 
 
 
 

Responses

Official Employee

 • 

398 Messages

1 y ago

Hi there GaelMartinez! Congratulations on the new gateway and thank you for taking the time to post your question about disabling the proxy! Have you already disabled the proxy settings on each connected device? 

Contributor

 • 

21 Messages

1 y ago

Hello Gina, the issue is not with web proxy, my devices aren’t using a http proxy. It appears than there is some transparent DNS proxying, which I suspect is coming from the gateway device... this has forced me to move services away from Comcast as it is directly impacting mail and dns services

Contributing Member

 • 

128 Messages

1 y ago

GaelMartinez, are you seeing the same errors if you allow the modem to route rather than the router? 
 
Ken

Contributor

 • 

21 Messages

1 y ago

I will test in a bit, on the phone with another support tech, I did confirm that outbound port 53/tcp traffic does not reach its destination when portscanning between one of my servers directly plugged into the gateway and my remote server...

Contributing Member

 • 

128 Messages

1 y ago

OK cool. I'll check back in with you later then! 

 

Contributor

 • 

21 Messages

1 y ago

Hello Ken

 

So after engineering looked at it, i was told it is not a comcast issue, "it is outside your boundaries for support"... it is an issue with my devices on the internet not recognizing my new modem....

 

Even if:

- the existing configuration worked for nearly 8 years until the modem was replaced...

- I can connect to various other servers on the internet on ports 48, 49, 50, 51,52,54,55,56 tcp but NOT 53 tcp/udp

- Looks like that new thingie Security Edge is definitively monitoring my dns traffic and cannot be turned off, the button is blocked ! I have my own security solution in place, I do not need comcast to restrict me like that...

- The fact that ANY ip on the internet does now appear as a valid functional DNS server when they should not !

- I'm impacted and cannot conduct my business as I did before 12/24 and had to rehost mail and dns servers to another location

- I cannot replace that gateway with my own without losing the static ips I have to avoid whatever firmware is impacting me

 

Thank you Comcast Business !... it is awesome to do business with you... I feel valued... not...

Official Employee

 • 

235 Messages

1 y ago

Hi! Thank you so much for providing this information and for your patience. I am sorry to learn that we have made you feel this way. We truly value you and are honored by your business. One option is seeing if we can find you a better bundle that does not include the Security Edge service. How does this sound?

Contributor

 • 

21 Messages

1 y ago

Hello Gabe,

 

I would love that a lot.

Official Employee

 • 

235 Messages

1 y ago

Fantastic! You are awesome for bearing with me through this. What I recommend from here is to give our Loyalty team a call at (800) 391-3000. Our Loyalty department are a team of specialists who are dedicated to resolving package concerns such as this. How does this sound? What I would like to do from here is follow up with you on Monday to make sure you were able to receive a solution from our Loyalty team since I will be offline for the weekend.

Contributor

 • 

21 Messages

1 y ago

Will call tomorrow, hope it solves my issue with the port 53 blockage... 

Official Employee

 • 

235 Messages

1 y ago

 

Sounds good. I will be offline until Monday, 12/30/19 so I will make sure to follow up with you then to ensure that you receive a solution. In the meantime, please feel free to reach out for any additional questions or concerns. We team is here for you 24/7!

Contributor

 • 

21 Messages

1 y ago

Hello Gabe

 

Called the loyalty team and was told they could not remove it as it was part of the current package i was moved into when I upgraded my bandwitdh...  the issue is still present and now the security edge website throws an error at me when trying to connect to it ..

 

Screen Shot 2019-12-30 at 11.34.46 AM.png

Official Employee

 • 

348 Messages

1 y ago

Hi there, I am so sorry to see that we have not yet reached a resolution with your concerns. I am so sorry for the delayed response and we do want to make sure that we can reach a resolution as quickly as possible and we can submit a request to look into this further for you. Can you please confirm the best contact number to reach you?  

Official Employee

 • 

508 Messages

1 y ago

I would love to look further into your DNS concerns. Can you please reach out through private message with your first and last name, full service address and account number or phone number and we would love to assist at any time. You can always reach us here through the business forums or you can reach out at any time through 1-800-391-3000 if this is a more convenient option for you. 

New Member

 • 

3 Messages

1 y ago

I seem to have the a similar problem and find myself increasingly annoyed as I discover all the problems with this router (CGA4131COM). What really bothers me is that I manually set my DNS, saved the settings..and they appeared to save as expected, yet, when I test those settings I find the DNS remain unchanged from default. I just got the router and this weekend was my first chance to learn about what I received. I started looking closer when I noticed problems with connection drops, which led to discovery of ipv6 issues... and on from there until I thought I was just going crazy.

 

Unfortunately I have court all day Monday but I will definitely need to speak to someone about rectifying the situation as soon as possible thereafter.

 

I would like to know how many of these routers were distributed to customers after significant issues were identified months ago? I hope I am just missing the solution thread and someone will point me to it real soon.