AC68U FW384.15 periodically looses WAN connection with unpredictable intervals

[JohnDeere]

Hi All,

can anyone please help me decode the log fractions below. I'm trying to find the reason for my periodical WAN disconnections. I have found some of my log reports in this forum but no real solutions for them...
e.g.:
Mar 02 11:53:35 RT-AC68U_WHITE kernel Dead loop on virtual device vlan2, fix it urgently!
Mar 02 12:21:06 RT-AC68U_WHITE pptpd MGR: Maximum of 100 connections reduced to 30, not enough IP addresses given

My log is flooded with these reports repeatedly each 3-4 minutes.
My NVRAM size is 59957, so it is below 61....
I have diversion and skynet installed.
My Asus DDNS is not working since I installed skynet - I don't know if this has anything to do with my disconnection problems.

If the log below is not relevant to my problem, please let me know what to look for in it. Thank you in advance!

Mar 02 11:47:51 RT-AC68U_WHITE Skynet Startup Initiated... ( skynetloc=/tmp/mnt/AC68U_EXT2/skynet )
Mar 02 11:47:51 RT-AC68U_WHITE miniupnpd shutting down MiniUPnPd
Mar 02 11:47:52 RT-AC68U_WHITE WAN(0)_Connection WAN was restored.
Mar 02 11:47:52 RT-AC68U_WHITE miniupnpd HTTP listening on port 32774
Mar 02 11:47:52 RT-AC68U_WHITE miniupnpd Listening for NAT-PMP/PCP traffic on port 5351
Mar 02 11:47:53 RT-AC68U_WHITE start_ddns update WWW.ASUS.COM update@asus.com, wan_unit 0
Mar 02 11:47:53 RT-AC68U_WHITE rc_service udhcpc 23210:notify_rc stop_pptpd
Mar 02 11:47:53 RT-AC68U_WHITE rc_service waitting "stop_vpnserver1" via udhcpc ...
Mar 02 11:47:53 RT-AC68U_WHITE ovpn-server1 event_wait : Interrupted system call (code=4)
Mar 02 11:47:54 RT-AC68U_WHITE inadyn In-a-dyn version 2.5 -- Dynamic DNS update client.
Mar 02 11:47:54 RT-AC68U_WHITE inadyn Update forced for alias xxxxxxxxxxxxx, new IP# xxxxxxxxxxxx
Mar 02 11:47:54 RT-AC68U_WHITE ovpn-server1 Closing TUN/TAP interface
Mar 02 11:47:54 RT-AC68U_WHITE ovpn-server1 updown.sh tap21 1500 1654 init
Mar 02 11:47:54 RT-AC68U_WHITE kernel br0: port 4(tap21) entering forwarding state
Mar 02 11:47:55 RT-AC68U_WHITE ovpn-server1 PLUGIN_CLOSE: /usr/lib/openvpn-plugin-auth-pam.so
Mar 02 11:47:55 RT-AC68U_WHITE ovpn-server1 SIGTERM[hard,] received, process exiting
Mar 02 11:47:55 RT-AC68U_WHITE kernel br0: topology change detected, propagating
Mar 02 11:47:55 RT-AC68U_WHITE kernel br0: port 4(tap21) entering forwarding state
Mar 02 11:47:55 RT-AC68U_WHITE kernel br0: port 4(tap21) entering forwarding state
Mar 02 11:47:55 RT-AC68U_WHITE kernel br0: port 4(tap21) entering forwarding state
Mar 02 11:47:55 RT-AC68U_WHITE kernel br0: port 4(tap21) entering disabled state
Mar 02 11:47:56 RT-AC68U_WHITE kernel br0: port 4(tap21) entering disabled state
Mar 02 11:47:58 RT-AC68U_WHITE rc_service udhcpc 23210:notify_rc start_pptpd
Mar 02 11:47:58 RT-AC68U_WHITE rc_service waitting "stop_pptpd" via udhcpc ...
Mar 02 11:47:58 RT-AC68U_WHITE custom_script Running /jffs/scripts/service-event (args: stop pptpd)
Mar 02 11:48:01 RT-AC68U_WHITE pptpd CTRL: Closing child BCrelay with pid 22155
Mar 02 11:48:02 RT-AC68U_WHITE custom_script Running /jffs/scripts/service-event (args: start pptpd)

Mar 02 11:53:35 RT-AC68U_WHITE kernel net_ratelimit: 18 callbacks suppressed
Mar 02 11:53:35 RT-AC68U_WHITE kernel Dead loop on virtual device vlan2, fix it urgently!
Mar 02 11:53:35 RT-AC68U_WHITE kernel Dead loop on virtual device vlan2, fix it urgently!

Mar 02 11:55:58 RT-AC68U_WHITE kernel device tap21 entered promiscuous mode
Mar 02 11:55:58 RT-AC68U_WHITE kernel ADDRCONF(NETDEV_UP): tap21: link is not ready
Mar 02 11:55:59 RT-AC68U_WHITE ovpn-server1 OpenVPN 2.4.8 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Feb 8 2020
Mar 02 11:55:59 RT-AC68U_WHITE ovpn-server1 library versions: OpenSSL 1.1.1d 10 Sep 2019, LZO 2.08
Mar 02 11:55:59 RT-AC68U_WHITE ovpn-server1 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Mar 02 11:55:59 RT-AC68U_WHITE ovpn-server1 WARNING: using --duplicate-cn and --client-config-dir together is probably not what you want
Mar 02 11:55:59 RT-AC68U_WHITE ovpn-server1 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Mar 02 11:55:59 RT-AC68U_WHITE ovpn-server1 PLUGIN_INIT: POST /usr/lib/openvpn-plugin-auth-pam.so '[/usr/lib/openvpn-plugin-auth-pam.so] [openvpn]' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY
Mar 02 11:56:00 RT-AC68U_WHITE ovpn-server1 Diffie-Hellman initialized with 2048 bit key
Mar 02 11:56:00 RT-AC68U_WHITE ovpn-server1 Failed to extract curve from certificate (UNDEF), using secp384r1 instead.
Mar 02 11:56:00 RT-AC68U_WHITE ovpn-server1 ECDH curve secp384r1 added
Mar 02 11:56:00 RT-AC68U_WHITE ovpn-server1 TUN/TAP device tap21 opened
Mar 02 11:56:00 RT-AC68U_WHITE ovpn-server1 TUN/TAP TX queue length set to 1000
Mar 02 11:56:00 RT-AC68U_WHITE ovpn-server1 updown.sh tap21 1500 1654 init
Mar 02 11:56:00 RT-AC68U_WHITE kernel ADDRCONF(NETDEV_CHANGE): tap21: link becomes ready
Mar 02 11:56:00 RT-AC68U_WHITE kernel br0: topology change detected, propagating
Mar 02 11:56:00 RT-AC68U_WHITE kernel br0: port 4(tap21) entering forwarding state
Mar 02 11:56:00 RT-AC68U_WHITE kernel br0: port 4(tap21) entering forwarding state
Mar 02 11:56:00 RT-AC68U_WHITE ovpn-server1 Could not determine IPv4/IPv6 protocol. Using AF_INET6
Mar 02 11:56:00 RT-AC68U_WHITE ovpn-server1 Socket Buffers: R=[122880->122880] S=[122880->122880]
Mar 02 11:56:00 RT-AC68U_WHITE ovpn-server1 setsockopt(IPV6_V6ONLY=0)
Mar 02 11:56:00 RT-AC68U_WHITE ovpn-server1 UDPv6 link local (bound): [AF_INET6][undef]:1194
Mar 02 11:56:00 RT-AC68U_WHITE ovpn-server1 UDPv6 link remote: [AF_UNSPEC]
Mar 02 11:56:00 RT-AC68U_WHITE ovpn-server1 MULTI: multi_init called, r=256 v=256
Mar 02 11:56:00 RT-AC68U_WHITE ovpn-server1 Initialization Sequence Completed

 

[JohnDeere]

Addition:

I see some of these kind of logs with different IP s, probably malicious:
Could this be the reason for my WAN disconnections?

Mar 02 13:13:15 84.236.80.130 pptpd CTRL: Client 92.63.194.81 control connection started
Mar 02 13:13:15 84.236.80.130 pptpd CTRL: Starting call (launching pppd, opening GRE)
Mar 02 13:13:15 84.236.80.130 pptp Plugin pptp.so loaded.
Mar 02 13:13:15 84.236.80.130 pptp PPTP plugin version 0.8.5 compiled for pppd-2.4.7, linux-2.6.22.19
Mar 02 13:13:15 84.236.80.130 pptp pppd 2.4.7 started by asusrouter, uid 0
Mar 02 13:13:15 84.236.80.130 pptp Using interface ppp10
Mar 02 13:13:15 84.236.80.130 pptp Connect: ppp10 <--> pptp (92.63.194.81)

Mar 02 13:14:18 84.236.80.130 pptp Using interface ppp12
Mar 02 13:14:18 84.236.80.130 pptp Connect: ppp12 <--> pptp (92.63.194.31)
Mar 02 13:14:18 84.236.80.130 pptp No CHAP secret found for authenticating 123456
Mar 02 13:14:18 84.236.80.130 pptp Peer 123456 failed CHAP authentication
Mar 02 13:14:18 84.236.80.130 pptpd CTRL: EOF or bad error reading ctrl packet length.
Mar 02 13:14:18 84.236.80.130 pptpd CTRL: couldn't read packet header (exit)
Mar 02 13:14:18 84.236.80.130 pptpd CTRL: CTRL read failed
Mar 02 13:14:18 84.236.80.130 pptpd CTRL: Reaping child PPP[3996]
Mar 02 13:14:18 84.236.80.130 pptpd CTRL: Client pppd TERM sending
Mar 02 13:14:18 84.236.80.130 pptpd CTRL: Client pppd finish wait
Mar 02 13:14:18 84.236.80.130 pptp Terminating on signal 15
Mar 02 13:14:18 84.236.80.130 pptpd CTRL: Client 92.63.194.27 control connection started
Mar 02 13:14:18 84.236.80.130 pptpd CTRL: Starting call (launching pppd, opening GRE)
Mar 02 13:14:18 84.236.80.130 pptp Plugin pptp.so loaded.
Mar 02 13:14:18 84.236.80.130 pptp PPTP plugin version 0.8.5 compiled for pppd-2.4.7, linux-2.6.22.19
Mar 02 13:14:18 84.236.80.130 pptp pppd 2.4.7 started by asusrouter, uid 0
Mar 02 13:14:18 84.236.80.130 pptp Couldn't allocate PPP unit 10 as it is already in use
Mar 02 13:14:18 84.236.80.130 pptp Couldn't allocate PPP unit 11 as it is already in use
Mar 02 13:14:18 84.236.80.130 pptp Couldn't allocate PPP unit 12 as it is already in use
Mar 02 13:14:19 84.236.80.130 pptp Using interface ppp13
Mar 02 13:14:19 84.236.80.130 pptp Connect: ppp13 <--> pptp (92.63.194.27)
Mar 02 13:14:20 84.236.80.130 pptp Connection terminated.
Mar 02 13:14:20 84.236.80.130 pptp Modem hangup
Mar 02 13:14:20 84.236.80.130 pptp Exit.
Mar 02 13:14:20 84.236.80.130 pptpd CTRL: Client 92.63.194.83 control connection finished
Mar 02 13:14:22 84.236.80.130 pptp appear to have received our own echo-reply!
Mar 02 13:14:22 84.236.80.130 pptp No CHAP secret found for authenticating 111
Mar 02 13:14:22 84.236.80.130 pptp Peer 111 failed CHAP authentication
Mar 02 13:14:22 84.236.80.130 pptpd CTRL: EOF or bad error reading ctrl packet length.
Mar 02 13:14:22 84.236.80.130 pptpd CTRL: couldn't read packet header (exit)
Mar 02 13:14:22 84.236.80.130 pptpd CTRL: CTRL read failed
Mar 02 13:14:22 84.236.80.130 pptpd CTRL: Reaping child PPP[4005]
Mar 02 13:14:22 84.236.80.130 pptpd CTRL: Client pppd TERM sending
Mar 02 13:14:22 84.236.80.130 pptp Terminating on signal 15
Mar 02 13:14:22 84.236.80.130 pptpd CTRL: Client pppd finish wait
Mar 02 13:14:23 84.236.80.130 pptp Connection terminated.
Mar 02 13:14:23 84.236.80.130 pptp Modem hangup
Mar 02 13:14:23 84.236.80.130 pptp Exit.
Mar 02 13:14:23 84.236.80.130 pptpd CTRL: Client 92.63.194.85 control connection finished
Mar 02 13:14:24 84.236.80.130 pptp Connection terminated.
Mar 02 13:14:24 84.236.80.130 pptp Modem hangup
Mar 02 13:14:24 84.236.80.130 pptp Exit.
Mar 02 13:14:24 84.236.80.130 pptpd CTRL: Client 92.63.194.31 control connection finished
Mar 02 13:14:28 84.236.80.130 pptp Connection terminated.
Mar 02 13:14:28 84.236.80.130 pptp Modem hangup
Mar 02 13:14:28 84.236.80.130 pptp Exit.
Mar 02 13:14:28 84.236.80.130 pptpd CTRL: Client 92.63.194.27 control connection finished

 

[ColinTaylor]

Exposing your pptp and OpenVPN servers to the internet on standard ports is a bad idea because it will lead to the persistent port scanning and hacking attempts that you're seeing. pptp shouldn't really be used at all as it is considered insecure. If you must use an OpenVPN server then run it on a non-standard port.

As for your other problem, check the modem's log for clues.

 

[alins]

I am having the same issue (periodic WAN connection loss) on 384.15 with an RT-AC86U. This has been happening for weeks and with a few slightly earlier firmware versions too. I get a connection loss roughly once or twice a week, and have to login to the router and reboot it to fix. Any help will be much appreciated. I am using Diversion on a USB key attached to the router, that is the only "extra feature" I am using.

Here is a summary of my log. The first part does not look good. What can I do? Thank you so much!

Mar 2 02:00:05 rc_service: service 5994:notify_rc restart_dnsmasq
Mar 2 02:00:05 dnsmasq-dhcp[1727]: failed to write /var/lib/misc/dnsmasq.leases: No space left on device (retry in 60s)
Mar 2 02:00:06 custom_script: Running /jffs/scripts/dnsmasq.postconf (args: /etc/dnsmasq.conf)
Mar 2 02:00:06 Diversion: restarted Dnsmasq to apply settings
Mar 2 02:00:06 dnsmasq[6117]: failed to allocate 60 bytes
Mar 2 02:00:06 dnsmasq[6117]: failed to allocate 60 bytes
Mar 2 02:00:06 dnsmasq[6117]: failed to allocate 68 bytes
Mar 2 02:00:06 dnsmasq[6117]: failed to allocate 57 bytes
Mar 2 02:00:06 dnsmasq[6117]: failed to allocate 58 bytes
Mar 2 02:00:06 dnsmasq[6117]: failed to allocate 62 bytes
Mar 2 02:00:06 dnsmasq[6117]: failed to allocate 57 bytes

[ I get TONS of these, maybe 1,000-2,000 lines and then:]

Mar 2 02:00:06 dnsmasq[6117]: failed to allocate 55 bytes
Mar 2 02:00:06 dnsmasq[6117]: failed to allocate 2048 bytes
Mar 2 02:00:06 dnsmasq[6117]: failed to allocate 2048 bytes
Mar 2 02:00:06 dnsmasq[6117]: failed to allocate 2048 bytes
Mar 2 02:00:06 dnsmasq[6117]: cannot read /tmp/resolv.dnsmasq: Cannot allocate memory
Mar 2 02:16:50 wlceventd: WLCEVENTD wlceventd_proc_event(401): eth5: Disassoc 000:2D:3B:2D:68, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8)
Mar 2 02:16:53 wlceventd: WLCEVENTD wlceventd_proc_event(420): eth5: Auth 000:2D:3B:2D:68, status: 0, reason: d11 RC reserved (0)
Mar 2 02:16:53 wlceventd: WLCEVENTD wlceventd_proc_event(449): eth5: Assoc 000:2D:3B:2D:68, status: 0, reason: d11 RC reserved (0)
Mar 2 02:31:21 wlceventd: WLCEVENTD wl

 

[ColinTaylor]

@alins Your problem is not the same as the one being discussed here. Those messages indicate that your router has run out of memory. It has been reported many times over the years. For example see here: https://www.snbforums.com/threads/clean-upgrade-to-384-15-dnsmasq-errors.61725/#post-549506

I suggest you report it in the Diversion thread.

 

[alins]

Thank you Colin. I did as you suggested. So this is a Diversion issue afterall.

 

[JohnDeere]

Exposing your pptp and OpenVPN servers to the internet on standard ports is a bad idea because it will lead to the persistent port scanning and hacking attempts that you're seeing. pptp shouldn't really be used at all as it is considered insecure. If you must use an OpenVPN server then run it on a non-standard port.

As for your other problem, check the modem's log for clues.

You are right, I agree, but I've been using it for long with these settings, and haven't had so much disconnections like these days...
However I will change settings, and see what happens.
Thank you.

How about the "dead loop" problem...? Do you have any idea?

 

[JohnDeere]

I have read in a very old post that this issue was known to exist in old firmwares. Is this also a problem which belongs to my modem...?
Mar 03 10:30:16 RT-AC68U kernel Dead loop on virtual device vlan2, fix it urgently!
Mar 03 10:30:16 RT-AC68U kernel Dead loop on virtual device vlan2, fix it urgently!
Mar 03 10:30:16 RT-AC68U kernel Dead loop on virtual device vlan2, fix it urgently!