Gateway set to unexpected PoE interface in ADSL modem

Question

This issue came up during a routine check on my router/modem settings. Details follow.

I use a TP-Link TD-W8901N ADSL modem (specs here) facing the internet. The modem manages a 192.168.1.x subnet, on which the only other device is a Belkin WiFi router residing at 192.168.1.100. The Belkin router acts as a router/DHCP server and creates its own 192.168.2.x subnet, which is where all my devices actually reside. [1]

On the Belkin router, the gateway and DNS are correctly listed as the TP-Link modem (192.168.1.1), which itself is supposed to get the DNS details directly from the ISP (no fancy overrides from my side).

On the modem itself, I expected to find the DNS to be the ISP default, and the gateway to be 192.168.1.1.


However, the gateway points to 192.168.1.224 - and no device I know of exists at that IP on my home network.

Further, the routing table in the TP-Link management interface shows the following entries:

#   Dest IP        Mask Gateway IP      Metric  Device  Use
1   192.168.1.224  32   192.168.1.224   1       poe7    0        
2   192.168.1.0    24   192.168.1.1     1       enet0   5871511      
3   default        0    Node8           2       poe7    6875620      

Google tells me the "poe7" interface refers to a "Power over Ethernet" device, but I don't have any of that sort, and definitely no devices other than the modem and the router on the 192.168.1.x subnet.

Further the "Use" stat of 0 indicates that this interface has actually never been used, and may therefore just be some cruft left over from the default settings of the modem.

But to check what this device/poe7-interface could mean, I ran nmap on it, with the following results:

dummy-system~: nouser$ nmap 192.168.1.224

Starting Nmap 6.47 ( http://nmap.org ) at 2015-07-05 02:10 IST
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 3.12 seconds

dummy-system~: nouser$ nmap -Pn 192.168.1.224

Starting Nmap 6.47 ( http://nmap.org ) at 2015-07-05 02:11 IST
Nmap scan report for 192.168.1.224
Host is up.
All 1000 scanned ports on 192.168.1.224 are filtered

Nmap done: 1 IP address (1 host up) scanned in 201.57 seconds

Which could in fact, mean that there is nothing at 192.168.1.224, as indicated by the original "0" Use Stat (which changed to "2" after running nmap twice), and bolster the "defaults cruft" theory. But this results in the following major inconsistencies:

1. If there is nothing at the *.224 IP, then what is it doing in my gateway IP field, and how is any traffic being routed properly at all, if *.224 is not a valid gateway/device IP?
2. And if it is a valid device or interface, why isn't nmap able to probe it better? Loading this IP directly in the browser also results in a "..the server where this page is located, is not responding" error.

Please help me understand this issue.

[1] I realize the setup maybe suboptimal - but it has worked quite well for me until now, and I'm reluctant to change that or go too far in messing with settings.

Answer 1

In this case, poe7 most likely indicates a PPPoE tunnel interface, which is the interface providing your DSL Internet connection. Power over Ethernet (PoE) is a feature provided on Ethernet interfaces, and would not change the name of the interface (it would still just be Eth0, Gig0, etc.).

The routing table here shows that the default route (gateway) is actually "Node8" (which could be an alias for 192.168.1.224) and it has a specific host route (/32) to 192.168.1.224. This /32 basically says "all traffic going to 192.168.1.224 will be sent out interface poe7" which means that 192.168.1.224 is on the other end of the PPPoE tunnel. 192.168.1.224 is most likely a firewall or a router interface, and will not respond to pings or show any open ports on a port scan.

You can only guess as to what's going on inside your service provider's network, but this should help you understand what is going on with your connection.