Bogus default gateway keeps appearing

[Zebulon Walton]

I've noticed for a while now that after booting up my Pinephone and connecting wifi that internet access wasn't working. It turns out that a default gateway of 192.168.225.1 on device "enxxxxxxxxxxxxx" is spontaneously appearing:

Code:

$ route -n
Kernel IP routing table
Destination    Gateway        Genmask        Flags Metric    Ref    Use Iface
0.0.0.0        192.168.225.1  0.0.0.0            UG    100    0       0 enxxxxxxxxxxxxx
0.0.0.0        192.168.10.1   0.0.0.0            UG    600    0       0 wlan0
192.168.10.0   0.0.0.0        255.255.255.0       U    600    0       0 wlan0
192.168.225.0  0.0.0.0        255.255.255.0       U    100    0       0 enxxxxxxxxxxxx

So to get internet access working I need to enter the command "route del default gw 192.168.225.1".

The phone is not connected to any other network device (no ethernet dongle, USB not connected to PC) and mobile networking is disabled - for that matter the modem is soft-disabled. Where is this phantom default gateway coming from?

[zetabeta]

blah

Code:

blah

blah

"enx############" is a physical network name and shows default the mac address. not recommended in public forums, although damage is not big.

my guess is, you have ethernet and wifi activated same time, but is it a remnant. other possibility could be vpn connection or similar, e.g. virtual network card. check your dongle's mac address and does it match.

manjaro's network name is "eth0".

[Zebulon Walton]

Oops, didn't stop to think that was a MAC address. As you said, not a whole lot of damage there but I went ahead and edited out the details anyway.

I did not have any other network adapters or a VPN active, though OpenVPN is installed. This just started happening fairly recently so I was wondering if it had to do with a Mobian update.

Running ifconfig with WiFi, USB tethering, and OpenVPN active results in the following adapters listed by ifconfig:

wlan0                      #WiFi
usb0                        #USB tether
tun0                        #VPN
lo                            #Loopback
enxxxxxxxxxxxx     #???????

I have not had the dongle connected to this thing in a long time, probably close to a year, but will check its MAC address.

To make things even more confusing, rebooting the phone after installing updates resulted in the bogus default route not being added, and that adapter now only has an ipv6 address bound to it. (Prior to rebooting it had a 192.168.225.x address. Network-manager was included in the updates which may or may not have something to do with it.) Bizarre, will have to keep an eye on it.

[Zebulon Walton]

Just booted the phone up a few minutes ago and the "phantom" bogus default route 192.168.225.1 is back. For now I added a quick 2-letter alias to make removal easy.

Code:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.225.1   0.0.0.0         UG    100    0        0 enxxxxxxxxxxxxx
0.0.0.0         192.168.10.1    0.0.0.0         UG    600    0        0 wlan0
192.168.10.0    0.0.0.0         255.255.255.0   U     600    0        0 wlan0
192.168.225.0   0.0.0.0         255.255.255.0   U     100    0        0 enxxxxxxxxxxxxx

[zetabeta]

maybe you should check files and contents in directory tree "/etc/network/". maybe there is something fishy.

check using command (sudo) "nmtui", if there is weird settings.

[Zebulon Walton]

maybe you should check files and contents in directory tree "/etc/network/". maybe there is something fishy.

check using command (sudo) "nmtui", if there is weird settings.

Nothing jumps out at me in /etc/network as being strange, though I'll admit to not knowing the purpose of all the scripts there. Same in nmtui, settings look OK and the only interfaces listed are USB ethernet and Wifi.

The problem is very strange and seems to be random. Sometimes when the phone is booted up that bogus route appears and other times (like right now) it doesn't. Have not noticed a pattern to it, at least not yet.

[jsch]

you might find sometihing within `/etc/NetworkManager`
sudo grep -rF 192.168.225. /etc/NetworkManager/

[Zebulon Walton]

you might find sometihing within `/etc/NetworkManager`
sudo grep -rF 192.168.225. /etc/NetworkManager/

Good idea, but it turns out there are no references to that subnet there or in /etc/network. Just for grins I searched all of /etc and nothing turned up.

However, I searched /var and found in /var/lib/NetworkManager there are a bunch of files that contain references to that subnet. They have names in this format:

Code:

internal-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx-enxxxxxxxxxxxxx.lease

...where the "x" characters are hex numbers. They are different for each file. The "enx" numbers at the end which appeared to be MAC addresses are also different in each one, so possibly this is a virtual adapter created on the fly? (I thought the adapter name in the routing table looked different this time!)

Contents of each of those files (apparently DHCP leases since they have the extension of .lease) look like this, with a different last 192.168.225.x octet in each:

Code:

# This is private data. Do not parse.

ADDRESS=192.168.225.29

So, apparently Network Manager is pulling these addresses from somewhere and installing a matching default route. (Currently there are 25 of these files in /var/lib/NetworkManager.) Another interesting thing is I've found that while the internet cannot be accessed while that route is in place, the address 192.168.225.1 responds to pings.

There is also a NetworkManager-intern.conf file which contains only comments, no active settings. Additionally there's a NetworkManager.state file containing the following:

Code:

[main]
NetworkingEnabled=true
WirelessEnabled=true
WWANEnabled=false

I read this as saying NetworkManager is aware that cellular internet is disabled.

Further, if I use ethtool to probe the enx* adapter, the following is reported. The speed reported appears to correspond to a USB2 connection:

Code:

Settings for enxxxxxxxxxxxxx:
Supported ports: [  ]
Supported link modes:  Not reported
Supported pause frame use: No
Supports auto-negotiation: No
Supported FEC modes: Not reported
Advertised link modes:  Not reported
Advertised pause frame use: No
Advertised auto-negotiation: No
Advertised FEC modes: Not reported
Speed: 425Mb/s
Duplex: Half
Auto-negotiation: off
Port: Twisted Pair
PHYAD: 0
Transceiver: internal
MDI-X: Unknown
        Current message level: 0x00000007 (7)
                              drv probe link
Link detected: yes
Supported ports: [  ]
Supported link modes:  Not reported
Supported pause frame use: No
Supports auto-negotiation: No
Supported FEC modes: Not reported
Advertised link modes:  Not reported
Advertised pause frame use: No
Advertised auto-negotiation: No
Advertised FEC modes: Not reported
Speed: 425Mb/s
Duplex: Half
Auto-negotiation: off
Port: Twisted Pair
PHYAD: 0
Transceiver: internal
MDI-X: Unknown
        Current message level: 0x00000007 (7)
                              drv probe link
Link detected: yes

However, the USB tethering adapter shows up as usb0, and ethtool only reports the following for it:

Code:

Settings for usb0:

Link detected: yes

So more clues here and it appears that NetworkManager is doing this but I still don't know why.