bk99.de entertain the web since 1997

bk99.de
Lutz Donnerhacke · TroubleshootingCurated

Night-time in Neuland: The firewall was not to blame

Summary

Lutz Donnerhacke reconstructs an apparent firewall failure and finds a time-dependent connection between provider maintenance, DHCP lease and manual reboots. The firewall obtained a DHCP lease with a lifetime of ten hours. The internet interface briefly dropped out at night and then came back.

Ideas

  • Regular outages point to schedules rather than random hardware faults.
  • Local logs disappear exactly when a device is hard rebooted.
  • An external syslog server preserves the history leading up to an outage.
  • Provider maintenance interrupts the modem while the firewall keeps running.
  • DHCP renews a ten-hour lease after roughly half its lifetime.
  • Manual reboots shift the renewal rhythm and hide the actual cause.

Insights

  • An effective workaround can make diagnosis harder in the long run.
  • Correlating times links seemingly independent events into a verifiable cause.
  • A reachable management interface refutes the claimed complete device failure.

Quotes

  • Denk ich an #Neuland in der Nacht, bin ich um den Schlaf gebracht. (“When I think of #Neuland at night, I lose my sleep.”) – Lutz Donnerhacke

Habits

  • Donnerhacke places syslog events, lease times and user interventions on a common timeline.

Facts

  • A reboot obtained an address immediately and restored the connection.

References

Critique

  • The reconstructed cause is not independently confirmed by provider logs.
  • The specific renewal behaviour cannot be transferred to every DHCP client.

Remarks

  • The article is both a fault report and a lesson about swapping components prematurely.
  • The timer switch illustrates how workarounds create new observation errors.

Recommendations

  • Send device log entries to an external log server before a reboot.
  • Record outage times, leases, maintenance windows and user interventions together.
  • Check partial functions before you assume a complete hardware defect.

Read the original article

Search the Web Archive

Lutz Donnerhacke · 2001

Firewall FAQ: Security is a maintained concept

Lutz Donnerhacke’s FAQ explains firewalls as a security concept that has to be maintained continuously and clears up common misconceptions about NAT, packet filters and desktop firewalls. The preserved page calls itself the FAQ of the newsgroup de.comp.security.firewall. The available version carries the version number 0.38.

Lutz Donnerhacke · 2026

Misconfiguration as a Service: Answering undeliverable traffic sensibly

Lutz Donnerhacke intercepts misrouted customer traffic to private addresses and examines safe responses that calm faulty devices and make misconfigurations visible. Among other things, DNS, LDAP, ICMP and solar inverter control traffic was observed. The provider network itself used 100.64.0.0/10 for its customers.

Lutz Donnerhacke · 2022

How network blocks come about because of sanctions

From an ISP’s perspective, Lutz Donnerhacke describes how sanctions lists lead to network blocks, overblocking and unclear responsibility between authorities and operators. The list at the time sometimes contained complete URLs instead of only domains. At least one operator who was contacted removed the linked content in question.