0

I know that the ISP will see the cloned mac address coming from the router, but what are the ramifications? I was working on a computer that mysteriously was being black listed from several popular websites (like usps.com). It was receiving a very generic "access denied" message.

However, when the router was set to clone the mac address of the computer, this no longer happened. Also when the router way bypassed all together, the websites were accessible. The ISP does not attempt to block routers. What is the explanation? There was no VPN connected, and we tried multiple browsers. I checked the security settings in the router and even with the firewall turned off it happened.

There's been reports of this on various forums, here's an example on reddit.

2

The MAC address will never be seen by an external web server, only the ISP's equipment to which your router connects will know the MAC address of your router. Systems beyond that piece of equipment will only know the external IP address at your end. The MAC address the web server will see will be the MAC address of whatever piece of network equipment sits in front of that web server, since the MAC address is at the Ethernet level, i.e, it appears in an Ethernet frame encapsulating an IP packet. Your IP packets will be re-encapsulated in different Ethernet frames as they traverse the Internet.

If you reboot your router, it may receive a new IP address from your ISP. The IP address on most home users' routers is usually assigned by DHCP, i.e, it is dynamic and subject to change over time as the lease time for the IP address expires or the router is rebooted and requests a new IP address. In some cases, though, an ISP's DHCP server may reassign the same IP address if you reboot, if the MAC address of your router hasn't changed. But, for those ISPs, if you change the external MAC address of your router, then the ISP's DHCP server will assign a different IP address.

It is possible that an IP address that your router received was assigned to someone else previously who engaged in malicious activity that resulted in that IP address being placed on a blacklist, or there could even be a system on your own LAN that was used for malicious activity unbeknownst to you, e.g. if it became part of a botnet. When you changed the MAC address of the router, it received a new IP address not on the blacklist, so access to those websites was no longer blocked, because they now saw a different IP address.

You can determine the external IP address that other systems will see by going to a site such as whatismyip.com that will display the IP address external systems, such as webservers see for network connections from your location. You could try changing the MAC address back to what it was previously, determine the external IP address it then gets, and, if you again have problems accessing particular websites you were unable to access previously, do a search on that IP address with Google or some other search engine to see if you find any results revealing it is on a blacklist. You could also search for the IP address on sites that monitor domain name and IP address reputations, e.g. BarracudaCentral IP/Domain Lookups, though its absence on any particular reputation list doesn't mean it isn't present on some other blacklist.

  • Yes, after cloning the MAC address to the router, the computer got a different IP address. So does the ISP try to assign the same IP address to the same MAC address? Is this some part of the DHCP? – northerner Aug 28 '17 at 3:17
  • @northerner, it depends on the ISP. DHCP servers will usually assign an IP address without regards to the MAC address of the requesting system. They'll just assign any available one from the DHCP address pool. But some DHCP servers can also be configured to assign a specific IP address based on the MAC address of the requesting system. – moonpoint Aug 29 '17 at 1:31
  • Then how do you figure "When you changed the MAC address of the router, it received a new IP address not on the blacklist"? I guess this ISP does do this. We tested by removing the cloned mac address from the clone and the computer went back to being blocked on several websites. – northerner Aug 31 '17 at 8:10

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.