Manually DHCP List and Domain Name Showing Unremovable Items

[kidd232]

I used WireGuard to connect two routers, RT-AX86U & GT-AX6600 running newest merlin firmware, and everything was working fine. However, over the past few days I noticed something strange:

．In both routers, the manual DHCP list and the domain name field started showing unusual entries that I cannot remove.

．In the Domain Name setting, asus.com keeps appearing. Even if I change it to another word or clear it completely, after clicking Apply it always reverts back to asus.com.

．In the DHCP list, three strange entries related to ASUS keep showing up. Just like the domain name issue, if I edit or delete them, they reappear shortly after. What’s odd is that these entries are on a different subnet — I’m not using the 192.168.1.0 network at all.

Does anyone know why this is happening?

 

[ColinTaylor]

What is the exact firmware version? "newest" could mean the current release version or latest beta version.

What scripts are you running on these routers, if any?

If you have JFFS custom scripts and configs enabled (Administration - System) I would temporarily disable that, reboot the router and see if the entries disappear.

You say these two routers are connected using WireGuard. The GT-AX6000's subnet is 192.168.0.0/24. What is the subnet of the RT-AX86U? They should be different if this is a LAN to LAN setup.

 

[dave14305]

To be cynical, I’d speculate some malware on the router wants to sinkhole any Asus update mechanism by redirecting the names to a local IP.

 

[ColinTaylor]

To be cynical, I’d speculate some malware on the router wants to sinkhole any Asus update mechanism by redirecting the names to a local IP.

I was thinking along the same lines (although there would be less obvious ways of achieving the same thing). Especially as his previous posts indicate that he was using AiCloud.

 

[kidd232]

What is the exact firmware version? "newest" could mean the current release version or latest beta version.

What scripts are you running on these routers, if any?

If you have JFFS custom scripts and configs enabled (Administration - System) I would temporarily disable that, reboot the router and see if the entries disappear.

You say these two routers are connected using WireGuard. The GT-AX6000's subnet is 192.168.0.0/24. What is the subnet of the RT-AX86U? They should be different if this is a LAN to LAN setup.

GT-AX6600: 3006_102.5_0, subnet: 192.168.0.0/24
RT-AX86U: 3004_388.9_2, subnet: 192.168.2.0/24

These two routers only have Skynet and Scribe installed via amtm.
I tried disabling JFFS custom scripts and configs, but the issue remains.

It seems like this is abnormal behavior, so I’ll need to do a reset.

 

[Poul Bak]

Do you use DDNS? That might explain the 'asus.com' thing.

Try checking the mac addresses here: https://maclookup.app/

Anyway, I would definitely do a factory reset.

 

[ppfoong]

Today I'm having the same issue as well after a router reboot.

Asus RT-AX86U, firmware 3004.388.9_2.

Nothing has been changed to the router settings and the firmware was updated since its official release here, quite some time ago.

All the while the router is OK, until today, after a manual reboot, the DHCP settings become like this. The router was rebooted last week too, by that time everything was still OK. This happened today, and despite multiple reboot, it behaves the same.

The "RT-AX86U's Domain Name" becomes "asus.com". After changing it to something else and applied the setting, it will revert back to "asus.com". It becomes unchangeable.

Also, all my static DHCP settings changed to only the 3 lines of setting, exactly the same as what kidd232 posted up here. The MAC address, IP address and Hostname of the 3 are exactly the same as his.

Manually change the DHCP list and save it, it will revert back to the 3 by itself. The DHCP list becomes unchangeable.

I SSH into the router and issued the "nvram show" command, I can see my previous DHCP settings are still in the "custom_clientlist" but the "dhcp_staticlist" has changed to this:
dhcp_staticlist=<00:0C:29:B6:9E:71>192.168.1.112>>dlcdnets<00:E0:4C:36:04:11>192.168.1.133>>routerahs<00:E0:4C:36:01:11>192.168.1.123>>routerfeedback

Anyone else facing the same issue? Anyone know what has happened?

 

[ppfoong]

Latest finding:

I can make the following change at SSH console:

nvram set dhcp_staticlist="<mac_address>192.168.0.2>>My_Computer"
nvram commit

But after I visit to this page from web browser, it will revert back to the 3 DHCP hosts:

https://192.168.0.1:8443/Advanced_DHCP_Content.asp