Help me figure this out : Unknown router on our network?

O

oober

Expert Member
Joined
Apr 3, 2005
Messages
3,080
Reaction score
84
Location
Gauteng
Our internal network range is 10.0.1.x so I stumbled upon 192.168.1.1 which goes via the internet to a mikrotik router (RouterOS v6.29.1).

When I do a traceroute I get :

traceroute to 192.168.1.1 (192.168.1.1), 30 hops max, 38 byte packets
1 * * *
2 41.193.3.101 (41.193.3.101) 58.629 ms 64.083 ms 53.238 ms
3 41.193.3.102 (41.193.3.102) 57.341 ms 56.395 ms 53.096 ms
4 196.41.12.0 (196.41.12.0) 56.767 ms 48.068 ms 57.018 ms
5 41.193.32.137 (41.193.32.137) 49.368 ms 35.792 ms 32.745 ms
6 41.193.32.198 (41.193.32.198) 45.294 ms 43.618 ms 53.211 ms
7 41.193.119.86 (41.193.119.86) 57.020 ms 55.980 ms 49.072 ms
8 192.168.1.1 (192.168.1.1) 61.506 ms 55.618 ms 53.464 ms

I'm no network/security fundi so if someone can make some sense of this?
 
LazyLion said:
Are you running any VPNs? Hamachi? etc?
Click to expand...

Not that I know of. I'm also thinking that this looks like a VPN network. I've done an ifconfig on our router and I can't see any interfaces that indicates a VPN connection. Any other way a VPN is running on the router where I won't see it this way?
 
oober said:
Not that I know of. I'm also thinking that this looks like a VPN network. I've done an ifconfig on our router and I can't see any interfaces that indicates a VPN connection. Any other way a VPN is running on the router where I won't see it this way?
Click to expand...

Well, you can do a firmware reset in your router just to be sure.
Find the reset button on the back of the router and press it in and hold for 20 seconds until you see all the lights reset.
Then re-enter your ISP info and check again.
You should also check if there is a firmware update for your router.

How many devices do you have on your network?
Download this advanced IP scanner and see what is running on your network...
http://www.advanced-ip-scanner.com/
 
LazyLion said:
Well, you can do a firmware reset in your router just to be sure.
Find the reset button on the back of the router and press it in and hold for 20 seconds until you see all the lights reset.
Then re-enter your ISP info and check again.
You should also check if there is a firmware update for your router.

How many devices do you have on your network?
Download this advanced IP scanner and see what is running on your network...
http://www.advanced-ip-scanner.com/
Click to expand...

Firmware reset hmm. Will need to backup my configuration then, running OpenWrt Barrier Breaker 14.07 on it with a lot of configuration that I don't want to lose. Will need to check each config file for suspicious content then.

There are a quite a few devices on it, lot's of phones/tablets, laptops. Let me do that ip-scan.
 
oober said:
Firmware reset hmm. Will need to backup my configuration then, running OpenWrt Barrier Breaker 14.07 on it with a lot of configuration that I don't want to lose. Will need to check each config file for suspicious content then.
Click to expand...
OK, ja - that's a bit more complicated then. I thought you were close to default! :D
oober said:
There are a quite a few devices on it, lot's of phones/tablets, laptops. Let me do that ip-scan.
Click to expand...
Remember, even phones can run VPN's.
 
Maybe I should try and drop all devices and see if this "VPN" connection disappears?
 
A traceroute to a non routeable IP via the internet can only be via a VPN. (Or some weird routing via your ISP)
Check on the mikotik - there must be a VPN config'd for this. Also have a look at the static routes on the router.

The logs on the router should also show the VPN tunnel being established.
 
Last edited:
how exactly did you stumble upon this IP?

It is unlikely a VPN. A VPN would usually not show hops in between as it tunnels traffic between two endpoints.
your traceroute shows this private IP available multiple hops through your providers network.

To be honest, it looks like something Vox is using on their own network that they have mistakenly allowed accessibility to.
Some providers use internal IP space for certain segments on their own network, it might be that
 
gregmcc said:
A traceroute to a non routeable IP via the internet can only be via a VPN.

Check on the mikotik - there must be a VPN config'd for this. Also have a look at the static routes on the router.
Click to expand...

The mikrotik is the unknown router on the other side of this VPN. I'm gonna drop all devices and see if it goes away. After that I might reset the OpenWRT(our) router.
 
syntax said:
how exactly did you stumble upon this IP?

It is unlikely a VPN. A VPN would usually not show hops in between as it tunnels traffic between two endpoints.
your traceroute shows this private IP available multiple hops through your providers network.

To be honest, it looks like something Vox is using on their own network that they have mistakenly allowed accessibility to.
Some providers use internal IP space for certain segments on their own network, it might be that
Click to expand...

I was trying to access another section of our network that is on the 192.168.0.x range and mistakenly typed 192.168.1.1.
I also thought if this, could VOX be so silly as to let this happen? VOX is our ISP yes.
 
gregmcc said:
A traceroute to a non routeable IP via the internet can only be via a VPN.

Check on the mikotik - there must be a VPN config'd for this. Also have a look at the static routes on the router.
Click to expand...

as above, not likely, it would be odd for the VPN to show that many hops. It normally shows 1 or two hops into the peer network before reaching destination. Public hops are unlikely, even more so that all hops belong to VOX


It would be helpful to know how this IP was found, can you telnet/ssh /https/http to it.
It might give an indication of the owner.

As per my post, i still suspect this is an IP used on VOX side for one of their devices, management, etc that isnt supposed to be reachable
 
Relooking at that I agree. Its a router at Vox that you probably shouldnt be able to reach. Probably best to just log a ticket with them and let them know you can get to one of their private IP's
 
syntax said:
as above, not likely, it would be odd for the VPN to show that many hops. It normally shows 1 or two hops into the peer network before reaching destination. Public hops are unlikely, even more so that all hops belong to VOX


It would be helpful to know how this IP was found, can you telnet/ssh /https/http to it.
It might give an indication of the owner.

As per my post, i still suspect this is an IP used on VOX side for one of their devices, management, etc that isnt supposed to be reachable
Click to expand...

That ip 192.168.1.1 is open to ssh port 22 yes.
 
oober said:
The mikrotik is the unknown router on the other side of this VPN. I'm gonna drop all devices and see if it goes away. After that I might reset the OpenWRT(our) router.
Click to expand...

im confused again, so you have a vpn to the mikrotik somewhere else, but mistakenly typed 192.168.1.x instead of .0

oober said:
I was trying to access another section of our network that is on the 192.168.0.x range and mistakenly typed 192.168.1.1.
I also thought if this, could VOX be so silly as to let this happen? VOX is our ISP yes.
Click to expand...

It happens sometimes. Although private IP's are not routable on the internet, this doesnt mean they cant be.
You default to your provider, if your provider has a route for the 192.168.1.x range, they will honour this.

Common practice is to do bogon filtering on the BRAS /BNG devices where clients like you terminate, to stop this happening.
There are a variety of reasons this could happen though, is your router from VOX managed by them at all?

Try https / ssh / telnet / http to the IP. It might give a logon or indication, otherwise just mail VOX and let them know this IP is reachable. Its probably some form of network management on their side
 
oober said:
That ip 192.168.1.1 is open to ssh port 22 yes.
Click to expand...

any logon banner?
If you really wanted to, you could run an identity scan against it and see what kind of device etc.
I wouldnt advise this, as it could get you into trouble.

As greg said, log a ticket with VOX telling them their device is reachable and oddly not locked down to specific IP's for ssh, ask for free goodies for reporting this :)
 
syntax said:
im confused again, so you have a vpn to the mikrotik somewhere else, but mistakenly typed 192.168.1.x instead of .0

It happens sometimes. Although private IP's are not routable on the internet, this doesnt mean they cant be.
You default to your provider, if your provider has a route for the 192.168.1.x range, they will honour this.

Common practice is to do bogon filtering on the BRAS /BNG devices where clients like you terminate, to stop this happening.
There are a variety of reasons this could happen though, is your router from VOX managed by them at all?

Try https / ssh / telnet / http to the IP. It might give a logon or indication, otherwise just mail VOX and let them know this IP is reachable. Its probably some form of network management on their side
Click to expand...

Yea I wanted to go to another part of our network, another router @ 192.168.0.1 and slipped and typed 192.168.1.1. And then I got this...

VOX Router.jpg
 
syntax said:
any logon banner?
If you really wanted to, you could run an identity scan against it and see what kind of device etc.
I wouldnt advise this, as it could get you into trouble.

As greg said, log a ticket with VOX telling them their device is reachable and oddly not locked down to specific IP's for ssh, ask for free goodies for reporting this :)
Click to expand...

No login banner on telnet or ssh.
 
Would be interesting to see if another VOX client can get to the same IP. Then you know for sure its a management router or something on their side. I'm 99% sure this is the case though.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X