192.168.1.1 A red warning pops up saying the connection is not private? Don’t scare yourself first, there are three looks and three methods

I bought the TP-Link TL-R470GP for my dad last year. A while ago, he sent a WeChat message saying that he couldn’t access the backend and attached a screenshot.: The entire page has white text on a red background, "Your connection is not a private connection," followed by the sentence "Attackers may try to steal your information, such as passwords, communications, and credit card information." The old man was so frightened that he turned off the WiFi on his mobile phone, thinking that someone had hacked the network at home. He waited until I got home at the weekend before he dared to touch it again.

I went home and took a look at his cell phone and solved the problem in thirty seconds. The router was not hacked, and the phone was not infected. It was just that Chrome automatically upgraded the address to https and knocked on the wrong door. It was worthless to put it bluntly, but it was just as scary as if something had happened. Today, open " 192.168.1.1 A complete breakdown of the "Red Warning" incident: What exactly does the warning say, how to click on each of the three types, and what to check if you still can’t get in after clicking on it. If you have come across this page recently, just follow it through.

First, find out what the warning is saying.: It's talking about certificates, not attacks

The original text in red on that page actually means "There is a problem with this website's security certificate." When a browser accesses an https address, it needs to verify a certificate, which is equivalent to asking the other party to present a letter of introduction saying "I am indeed this website." The router backend is not equipped with a formal certificate at all - and does not need to be, so the browser cannot verify it and throws the most terrifying paragraph in your face.

There is a key premise that needs to be broken down here.: What you lose is 192.168.1.1 , this is basically an intranet address. The data travels two meters from your mobile phone to your home router, without passing through the operator or the public network. Anyone who wants to intercept this data must first get into your home WiFi. And people who can get into your home WiFi don't have to bother to capture packets at all, they can just log in to the background and change the settings. Therefore, the risk of "clear text" ranks very low in your yard.

When I was looking through the backend logs before, I checked my own attack surface. Which one is more worth worrying about?: The scanner knocks on the remote management port of the router from the public network. Thousands of login failures occur every week, all from overseas. That's when someone is really trying your door lock. In contrast, the red text on this page is just that the browser does not understand the rules of the intranet and made an error. I really want to block the public network door, so I go to the backend first and turn off the remote web management. Do you need to enable remote web management of the router? A complete judgment was written in that article.

There are three ways to do it, first get the right position and then take action.

The red warning looks different on mobile phones and computers, and the processing paths are also different. I have classified them into three categories based on what I have seen on my own and other people’s machines. You can check the numbers first.:

The first type is the easiest to recognize. The entire page is full of warnings, and the entire text is blocked. There is no place to enter the password. My dad's phone has this kind of device. Chrome puts it in the address bar. 192.168.1.1 automatically changed to https://192.168.1.1 , the router only opened the http door, and no one answered the https door, so the browser rendered "no one answered the door" as "this place is dangerous." This is the browser's policy, not the router's fault.

The second kind is the most unjust. The page opens normally, and the login box is there, but there is a small gray word "Not Safe" hanging next to the address bar. Someone just glanced at it and closed the page. I want to do it justice: The HTTP background of intranet equipment is like this. No matter how clear the management password you enter is, it will not leave your house. If the password should be strengthened, ignore this prompt.

The third type is the most annoying. I clicked "Continue Access" or "Advanced" on the warning page, but I still can't get in, and the screen turns white. This is not a matter of simply pointing out the method. It needs to be investigated further. I will make a separate section later.

first thing: Type in the entire address and bring http://

To deal with my dad's machine, I did one thing. Click on the address bar to delete the original record and type again.: http://192.168.1.1 , put the http:// prefix, press Enter, and the login page will come out immediately. When the browser sees the beginning of http://, it will understand that this is the URL to be accessed, and will not upgrade to https on its own initiative. This is the right door.

Here is a detail on the mobile phone. Many people don’t know that they are stepping on the same trap.: Current mobile browsers merge the address bar and search box into one space. You can type 192.168.1.1 , it throws keywords to search engines as preconceived ideas. I am here Log in to the router backend via mobile phone I wrote about this in that article, and the solution is to add the http:// prefix, which kills two birds with one stone. It is neither used as a keyword nor forced to jump to https.

By the way, develop a habit: After successful login, a history will be left in the address bar. Next time you want to enter the backend, click on the address bar and click on the complete http address directly from the history. It is faster than typing again and avoids typing mistakes with a swipe. Some third-party browsers will also record "This site must be https" in the site data. If it still jumps no matter how hard you check, then you have to take the next step.

The second thing: Clear site data recorded by browser

If the address is still forced to jump to https after typing in all the addresses, it means that the browser has saved the "upgrade memory" of this site. This memory is stored in the site data and will be invalidated if cleared.

The paths for Chrome and Edge are: Settings, privacy and security, third-party cookies or site settings, search there 192.168.1.1 , delete the found item, and go back to the browser to re-enter. Mobile Safari does not have such a detailed entrance. Go to the "Settings-Advanced-Website Data" layer and find 192.168.1.1 Cross it out. The Quark browser on my wife’s iPhone is even better. The site data entry is hidden in a place where I have been looking for it for ten minutes. If I really can’t find it, I’ll try another idea.: Just switch to the Safari that comes with your phone and open it once. The built-in browser is generally much more honest about intranet addresses.

After clearing and re-entering, 90% of the pages with red letters are gone. If it hasn't happened yet, don't rush to click "Continue Visit" repeatedly - no new results will appear after clicking that button for more than a dozen times. Instead, some browsers will mark this site as "User ignored warnings multiple times", and subsequent prompts will be more frequent. It’s time to change tools.

The third thing: Try using the browser that comes with your phone

After clearing the data, the warning still pops up. The problem probably lies with the browser itself. In order to block advertisements, third-party browsers will insert interception scripts into the page. Small pages such as the router login page are most likely to be accidentally damaged. The script is blocked and the page is interrupted halfway through loading. It looks like the warning page is stuck. My neighbor was using a browser with the word "Comprehensive Protection" at the time. He switched to the one that comes with the system and logged in right away.

So my suggested order is fixed: Type in the full address first, and then clear the site data. It is really impossible to change the built-in browser. The internal logic of this sequence is arranged from the cost - it costs zero to enter the address, clear the data for one minute, and change the browser for two minutes. Each step eliminates a variable, and you can stop at the right step. Don't restart the router as soon as it comes up, let alone reset. A browser display problem won't cause a factory reset of the whole house network. The broadband account, WiFi password, and port mapping all need to be reset. I'm here Back up router configuration In that article, I wrote about things to copy before resetting, but if you can't do the reset, don't do it.

Have you dealt with all the warnings and still can't get in? Check these three real faults

After completing the first two steps, the page can be opened, but if it is stuck somewhere else, then it may be a real malfunction. I have only seen three kinds, you can answer them one by one.

The first is that the house number of your router is not at all 192.168.1.1 . This address is the old default value. Many models of Mercury and Tenda are shipped from the factory. 192.168.0.1 , Xiaomi is 192.168.31.1 , Telecom optical modem and 192.168.2.1 of. No need to guess how to check: There is a line for "gateway" or "router" in the mobile phone WiFi details. That is the real address, so type it accordingly. The night I helped my mother-in-law install a camera, I relied on this trick to find the real house number of her Mercury home. How to distinguish the house numbers of the two houses? 192.168.1.1 and 192.168.0.1 The difference That article was detailed.

Second, you are not connected to your own WiFi at all. I bumped into my neighbor’s WiFi name, and my phone automatically connected to his house. Of course, the background of your router cannot be opened. Take a look at the gateway IP in the WiFi details to see if it matches your impression. If you make a mistake, just switch it back manually and that's it.

The third way is to jump to the operator's page from the login page. That means you are entering the backend of Optical Mode. Both Optical Mode and the router used the same address, and there was a fight. I wrote down the process of retrieving the background in three steps: Can access the Internet but can't log in The core of that article is to first confirm who is in charge of the current 1.1, and then change one side to another network segment. It is the most annoying of the three, but it is also a thing that can solve the problem once and for all.

Two things you can do easily to avoid being scared in the future

The first thing is to set the background password to a mixture of 12 or more characters. The scary nature of the red text on this page is to make you wonder, "Is it safe to enter the password here?" However, the real value in the background of your home is the lock itself. The lock is strong enough, and it doesn’t hurt to run a two-meter network cable for plain text. ； The lock is admin, and https cannot save it. How do I come up with a strong password that I can remember? I'm here Management password physical examination That article gave a ready-made method, which is to add the first letter of the pinyin of a personal sentence to the year, which is ten times better than the birthday mobile phone number.

The second thing is to save a bookmark or note to the backend address. Whether it is a red letter warning, forced https redirection, or search hijacking, half of the pitfalls come from the step of "retyping the address." After successfully entering the backend using the http:// prefix for the first time, save an entry in the browser bookmarks or create a shortcut on the desktop. In the future, you can enter from the bookmarks and bypass the address bar. This is how my dad uses it now, and he hasn’t come back to me for half a year.

At the end, go over the sequence again: Type in the full http:// address, clear the site data, and use your own browser. If that doesn't work, check the house number, WiFi, or cat fight. The phrase "attackers may steal your information" on the red warning page is a common lingo of browsers. For the small door of your home network, it refers to the fact that the certificate is not qualified, not that someone is squatting outside the door. Distinguish this, and next time you see the red letter, at least you won’t turn off WiFi first.