Two DNS requests to amazonaws every 30 seconds since installing AIMesh

[dave14305]

Sure does. I do think you found the issue sir.

There’s some references to Tencent in this awsiot code. Does that ring a bell? Not sure what country you’re in, but worth a shot.

 

[dave14305]

Oh, how about going to the Administration/ Tweaks tab and setting “Disable Asusnat tunnel” to yes.

 

[bennor]

Sigh... that would involve a whole bunch of DHCP Manual IP address reentry, for like 50 devices.

There are a number of methods one can use to export and reimport the LAN DHCP Manual IP addresses. In addition to the suggestion already made there is YazDHCP which is a GUI interface method of saving/importing the manual IP addresses.

YazDHCP - YazDHCP v1.0.8 - Feature expansion of DHCP assignments (increasing limit on the number of DHCP reservations)

Release Notes for YazDHCP v1.0.8 production release now available [2025-May-29] The fork from @Jack Yaz's repository is now hosted on the AMTM-OSR GitHub repo: https://github.com/AMTM-OSR/YazDHCP 1) FIXED: Errors when loading the webGUI page on the 3006.102.x F/W version. 2) FIXED: Some...

www.snbforums.com

 

[ColinTaylor]

Another thing you can try is to go to Administration - Policy and Withdraw from the ASUS PRIVACY NOTICE.

 

[Qwinn]

Oh, how about going to the Administration/ Tweaks tab and setting “Disable Asusnat tunnel” to yes.

Sure - but this is interesting. While I was trying to figure out why I couldn't do that account binding crap, that very same parameter came up as the reason for the fails I was getting.

https://www.reddit.com/r/ASUS/comments/1kz04o5/for_those_having_trouble_binding_the_asus_router

That link says the fix for getting account binding working is to ENABLE the tunnel. I didn't actually try it, since I don't really want it bound.

But the problem with your solution is that it was already disabled. Already set to yes. Should I try enabling? And this does interfere with active connections at all?

Another thing you can try is to go to Administration - Policy and Withdraw from the ASUS PRIVACY NOTICE.

View attachment 66730

Interesting. I didn't know what that would actually cost me. I... really don't think I need any of those features. At least not for the moment. I am a privacy junky so I do think I'm willing to try that option for now. Tho not sure what "Notification" and "Config Transfer" entail, those seem possibly useful.

 

[dave14305]

But the problem with your solution is that it was already disabled. Already set to yes. Should I try enabling? And this does interfere with active connections at all?

Maybe so.Perhaps it will clear out whatever pending transaction it thinks it has. Then disable it if the logs and queries stop.

 

[Qwinn]

Maybe so.Perhaps it will clear out whatever pending transaction it thinks it has. Then disable it if the logs and queries stop.

Tried it. No joy. No change in awsiot errors.

 

[Qwinn]

BUT! Withdrawing ASUS Privacy Notice DID work. Woohoo. Thanks Colin.

I'm okay with those features being disabled for now, though I may want to enable WAN access someday through VPN. Does withdrawing from that prevent THAT kind of remote connection? If so, not great permanent solution. Hmm.

Anyway. Re-disabled Asusnat tunnel as that didn't seem to help anything, and I don't care for what I can determine about its purpose - again, at least for now.

 

[Qwinn]

Now I just gotta figure out what to do about this :/

I think first obvious thing to do is to just reboot and see if that fixes it. Which I can do in a bit. Since no one else mentioned it I assume the solution isn't obvious.

 

[dave14305]

Now I just gotta figure out what to do about this :/

View attachment 66731

I think first obvious thing to do is to just reboot and see if that fixes it. Which I can do in a bit. Since no one else mentioned it I assume the solution isn't obvious.

Look for browser errors in the F12 developer console tab. Make sure no adblocker is enabled while on the router URL.

 

[ColinTaylor]

BUT! Withdrawing ASUS Privacy Notice DID work. Woohoo. Thanks Colin.

I'm okay with those features being disabled for now, though I may want to enable WAN access someday through VPN. Does withdrawing from that prevent THAT kind of remote connection? If so, not great permanent solution. Hmm.

I think it's referring to things like AiCloud. Merlin has implemented his own OpenVPN support so it shouldn't effect that. If you need DDNS it will likely just ask you for permission again.

 

[Qwinn]

I think it's referring to things like AiCloud. Merlin has implemented his own OpenVPN support so it shouldn't effect that. If you need DDNS it will likely just ask you for permission again.

Hmm, based on research up to now I woulda preferred Wireguard to work with Tailscale (I don't know a lot about this yet, never actually done it), but it's good to know that'll be an option. As for DDNS, eh, I suppose I could always set up a separate non-router DDNS updater to use with no-ip, or whatever, rather than open up all those privacy invasions again.

 

[Qwinn]

Look for browser errors in the F12 developer console tab. Make sure no adblocker is enabled while on the router URL.

Okay, checking that out has, I think, pointed me in the right direction, but not sure how to fix it.

So on my Administration -> System page, near the bottom, I have this setting set:

Note where it's repeating the 8443 port where it tells me to access it. I in fact access my page via just "bifrost:8443". I did notice that on the setting page a few days ago but dismissed it as it didn't seem to be causing me any issues - but when I look at the F12 on that system status page, it does seem like it's understandably choking while trying to access bifrost:8443:8443. Any ideas how I can fix that? I presume as long as Administration -> System is showing that "Access setting page via" error, system status will remain broken. Just trying to reenter it and hitting Apply isn't fixing it.

 

[Qwinn]

Okay! Figured it out!

If I access my router GUI via just 192.168.1.1:8443, or via www.asusrouter.com:8443, system status page works fine. It's only if I try to access it via "bifrost:8443" that system status breaks. "bifrost" *should* be translating as just 192.168.1.1, that's what it's set to in my daily driver's /etc/hosts (well, actually, "Bifrost", capitalized, dunno if that matters, but this is Linux), not sure why GUI would seem to be translating it as 192.168.1.1:8443.

 

[dave14305]

Okay! Figured it out!

If I access my router GUI via just 192.168.1.1:8443, or via www.asusrouter.com:8443, system status page works fine. It's only if I try to access it via "bifrost:8443" that system status breaks. "bifrost" *should* be translating as just 192.168.1.1, that's what it's set to in my daily driver's /etc/hosts (well, actually, "Bifrost", capitalized, dunno if that matters, but this is Linux), not sure why GUI would seem to be translating it as 192.168.1.1:8443.

It’s interesting in that @RMerlin made changes recently to fix some problems with the hostname. Maybe he’ll be interested in this report, in case it’s unintended side effects of that change.

httpd: fix get_header_info returning truncated hostnames in certain s… · RMerl/asuswrt-merlin.ng@ce67ba4

…cenarios This was causing the webui networkmap to fail loading the status frame if your hostname was something like 1234myhome.mydomain.com - it was getting truncated to myhome.mydomain.com.

github.com

 

[RMerlin]

You need to use the hostname configured within the router, you cannot define an arbitrary name in your client's hostname and expect it to work. This is because of Asus' recent changes to improve security against XSS attacks.

 

[Qwinn]

You need to use the hostname configured within the router, you cannot define an arbitrary name in your client's hostname and expect it to work. This is because of Asus' recent changes to improve security against XSS attacks.

Is it case sensitive? Because "Bifrost" *is* the hostname, at least if you mean what I think you mean.

Problem is, if it *is* case sensitive, I've yet to find a way to make my browser *not* change it to lower case, even if set up capitalized in a bookmark.

 

[RMerlin]

I don't know, I don't have access to the backend code that generates the header information pushed to the webpage. All I know is that in some scenarios, such as when using an arbitrary name, the web server doesn't push the object containing the connection info, so the page fails to load properly. In my tests it works fine with a real legitimate hostname that can be resolved within my LAN, but it fails if I use an arbitrary name that I configure in my local host file.

 

[Qwinn]

I see. Well, I have it set up as "Bifrost" both in the LAN section of the GUI (as I posted a pic of) and in my etc hosts of my linux box where I'm accessing the GUI from. The case issue is the only thing I can come up with for how I could be even theoretically deviating from what you're saying here (and only because my browser - Brave - is forcing the url to lower case)

 

[RMerlin]

I can try at least analyzing the visible portion of the code that generates the header info object to see if I can see anything specific with that particular scenario that would result in an invalid object, but I'm not too optimistic that it's something I can adjust.