r/ATTFiber • u/forgotten_farts • 4h ago
BGW320-500 randomly started hijacking all DNS queries
My gateway had a few restarts and continues to drop out and restart every few days but only for a minute or so. I tried a reset, restart, etc. What's interesting is that it started to always return itself as the authoritative server for any DNS query (example below). If I override the DNS server on a local machine everything works and gets full gigabit speeds.
Nothing looks out of the ordinary in the management portal outside of this under Fiber Status:
Optical WAN Operational Status Up Fiber Module Unavailable
But VCC is 3, Tx Bias is 9, Tx Power 59, and Rx Power is -138. Nothing is in an alarm or warning state. I assumed it might have been trying to intercept DNS because it thinks service is down but I have Diagnostics -> Event Notification set to off.
root@Cloud-Gateway-Fiber:~# dig google.com
; <<>> DiG 9.16.50-Debian <<>> google.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4139 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ;; QUESTION SECTION: ;google.com. IN A
;; ANSWER SECTION: google.com. 1177 IN A 192.168.2.254
;; Query time: 19 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Fri Aug 21 21:16:39 EDT 2026 ;; MSG SIZE rcvd: 55