u/FAcup

TL;DR: My Netgear EAX12 WiFi extender intermittently intercepts DNS and answers external lookups with its own LAN IP (192.168.1.250 → routerlogin.net), breaking HTTPS with cert errors. Proven it's the extender (unplug it = stops). Latest firmware doesn't fix it, and there's no DNS setting in its UI. Looking for a way to disable this behavior.

Setup

• ISP router (192.168.0.1) → Netgear R8000 as the main router (LAN 192.168.1.0/24). So yes, double-NAT.
• 2× Netgear EAX12 extenders, wired ethernet backhaul, broadcasting the same SSID as the router ("One WiFi Name").
• ~20 devices rely on the extenders for coverage (the R8000's own WiFi is weak in my office).

Symptom

• Intermittently, a fresh DNS lookup for an external domain (e.g. api.github.com) resolves to 192.168.1.250 instead of the real IP. HTTPS then lands on the extender's routerlogin.net admin page → TLS cert error.
• Irregular — bursts and lulls, averaging every few minutes, not on a fixed schedule.
• Only fresh/uncached lookups are hit. Established connections (Zoom, open tabs) are totally fine, and raw internet (ping 1.1.1.1 by IP) never drops. So it's purely DNS, and only a fraction of lookups at a time.

How I proved it's the extender

• dig @192.168.1.1 api.github.com intermittently returns 192.168.1.250.
• Even dig @8.8.8.8 and dig @1.1.1.1 (aimed straight at public resolvers) get intercepted and return 192.168.1.250 — so it's transparently grabbing ALL port-53 traffic regardless of destination.
• 192.168.1.250:443 serves a NETGEAR cert, CN=www.routerlogin.net.
• Unplug the extender → hijacking stops completely (verified 24 min clean). Plug it back in → it returns. As definitive as it gets.

Already tried / ruled out (please don't just suggest these)

• Updated EAX12 firmware to the latest (1.0.3.38) — no change. Netgear's changelogs never mention DNS.
• Checked every menu in the EAX12 web UI — there is no DNS / secure-DNS / resolver setting (only "Always use HTTPS to access extender," which is just for the admin page).
• Set the router's upstream DNS to 1.1.1.1 / 8.8.8.8 — no effect (the extender intercepts regardless of destination).
• Unplugged the second extender — no change.
• Router logs show no WAN/internet drops; the internet itself is rock stable.
• (I know per-device encrypted DNS/DoH sidesteps it, since the extender can't read encrypted queries — but I'm after a network-level fix or a way to stop the extender doing this, not configuring 20 devices individually.)

One lead I'm chasing The extender's wired backhaul only negotiates 100M/Full at the router (should be gigabit — smells like a damaged cable pair). I'm wondering if a flapping/marginal link makes the extender think it's lost its upstream and flip into this captive-portal DNS-redirect mode. The bursty, irregular timing would fit a flapping link.

Questions

1. Is this a known EAX12 / Netgear extender behavior? Any way to disable the captive-portal DNS redirect?
2. Does the EAX12 have a true Access Point / Bridge mode that disables the internet-check + captive DNS? Is it hidden in the Nighthawk app or the setup wizard (it's not in the web UI)?
3. Does the marginal 100M backhaul sound like the likely trigger — i.e., does this firmware captive-redirect DNS when it thinks the upstream is flaky?

Thanks in advance — happy to run any diagnostic commands and report back.

---

This issue was investigated with the help of Claude (Anthropic's AI assistant), and this write-up was produced by it.

As title. I need to transfer my ticket to someone and I needed to update my phone number to a new one. You'll need to verify your email and give a photo of yourself and your ID in order to change your phone number from one you no longer have access to.

As the title really. I have a ticket I want to transfer to someone else as we're arriving on different days. The ticket was bought from the resale in wondering if that makes a difference at all.

The ones that might be possible.

1. Electric Callboy and Babymetal.
2. Babymetal and Bloodywood.
3. Babymetal and Tom Morello.
4. Cypress Hill and Tom Morello.
5. Ice Nine Kills and Matt Heafy.

Thanks to chatgpt for those last 2.

Bonus!
Keanu Reeves and Ice Nine Kills for The Great Unknown.

I'm arriving on the Thursday with a lot of gear, enough for 4 people. I'll have a trolley with all the gear on it. We have quiet camping tickets so I'm wondering if I can get into quiet camp and get setup without having to drag all my gear through the wristband exchange.