Constant port scans on my router WAN (Afrihost on Openserve)

Gimli_ said:
This weekend I spent a good couple of hours staring at my live firewall logs. What I saw was constant port scans from IPs all across the world (Bulgaria, America, Netherlands etc.) Not even scanning random ports, just going down the list like 39000, 39001, 39002 etc. I disconnected for a while to force a new IP address but that did not change, just the source IPs changed.

My firewall drops the packet, it doesn't block the packet (there is a difference).

My question is, should we just live with it and trust our CPE? Or should we be asking our ISPs to implement some algorithm to identify port scans and block them so that they can't even reach us?
Click to expand...
Your ISP will do some DDos protection if you are lucky, but securing your network is your responsibility.

Step one, is chuck the ISP supplied router in the bin and get something that actually gets its CVE's patched and does some reputation and signature based blocking. Most ISP supplied routers are insecure because they never get software updates and support from the manufacturers.

Ubiquiti gateways do a decent job of making it easy for the average person, but if you know what you are doing, you can get by with something cheaper running OpenWRT or a Mikrotik Router.

But this level of port scanning is normal, in todays age
1785832993680.png

In the last 30 days, 6% of incoming traffic packets were dropped due to signature and reputation rules.
 
Last edited:
rustypup said:
or put something robust between that on your LAN/s

But step zero should be disable UPnP and see if you can permanently damage it so it cannot be enabled again.
Click to expand...
The router can still mess with your internet, inspect your traffic and participate in botnets using your connection.

Best to remove insecure devices entirely.
 
ISP is very unlikely and will be hesitant to block or drop any traffic. It simply is not their responsibility and the repercussions of blocking legitimate traffic is not something they have an appetite for. They would also need to put devices in place that inspect, analyze and block traffic, this is expensive and intrusive.
Some offer DDoS, but this is to protect their backbone / core network, DDoS protection (proper DDoS, not something like RTBF) is very expensive and will be a paid for service.
Port scans are just part of life, if you want cleaner logs, filter them
 
Sapphiron said:
The router can still mess with your internet, inspect your traffic and participate in botnets using your connection.

Best to remove insecure devices entirely.
Click to expand...
A standard home router is extremely unlikely to do proper inspection, especially on encrypted traffic. Most just do layer 4 filtering and DNS filtering
 
syntax said:
A standard home router is extremely unlikely to do proper inspection, especially on encrypted traffic. Most just do layer 4 filtering and DNS filtering
Click to expand...
Once its part of a botnet, its no longer standard. Botnets will often send their own application binaries to leverage unimplemented features in the hardware.
 
Sapphiron said:
Your ISP will do some DDos protection if you are lucky, but securing your network is your responsibility.

Step one, is chuck the ISP supplied router in the bin and get something that actually gets its CVE's patched and does some reputation and signature based blocking. Most ISP supplied routers are insecure because they never get software updates and support from the manufacturers.

Ubiquiti gateways do a decent job of making it easy for the average person, but if you know what you are doing, you can get by with something cheaper running OpenWRT or a Mikrotik Router.

But this level of port scanning is normal, in todays age
View attachment 1927093

In the last 30 days, 6% of incoming traffic packets were dropped due to signature and reputation rules.
Click to expand...
Ok I have used Opnsense for 5 years and before that PFSense for many years (10+). I think I am covered. Just commenting on the amount of port scanning. Mine looks like about 30% incoming is dropped.
 
SauRoNZA said:
Well then say port forwarding.

The default NAT (masquerade)has to exist.

You can’t not have it.
Click to expand...
Weird. Deal with 3 distinct NOC teams on a daily basis and they are absolutely not, in any way, means or form, confused about this usage.
 
What simple s/w tools are recommended these days for the casual or not up to date user? All we use is uBlock Origin and our VPN (Windscribe which has lots of protect tricks up its sleeve) , but largely running on Linux here so that helps.
Not allowed to change our LTE Router.

The Windows PC's here additionally have antivirus & antispyware etc.
 
Brian_G said:
our VPN (Windscribe which has lots of protect tricks up its sleeve)
Click to expand...
This is actually... not great. Unless there is an actual FW managing it.

VPN == Extension of trust and direct access to a network over which you have zero visibility or control.
 
rustypup said:
This is actually... not great. Unless there is an actual FW managing it.

VPN == Extension of trust and direct access to a network over which you have zero visibility or control.
Click to expand...

Thanks
I did extensive research on them and have chatted to support many times through the years, am convinced they're totally trustworthy and competent. They do all their own funding, have over 100 million registered users.
As for a firewall - there's one built into the desktop app, presume their servers are just as competent.
 
Brian_G said:
I did extensive research on them and have chatted to support many times through the years, am convinced they're totally trustworthy and competent. They do all their own funding, have over 100 million registered users.
As for a firewall - there's one built into the desktop app, presume their servers are just as competent.
Click to expand...

A VPN does not give you the protection that you think it does. It simply encrypts and pushes the traffic out over winscribe's network. Yes, they give you some protection (likely more dns based, in that you wont be able to access bad server x.x.x.x etc), but your network itself still interfaces the internet at your router, your front door. Nothing that windscribe can do to protect you from incoming traffic at that door.

You are lucky though, in that you are using an LTE router you say? The default APN should give you some protection as the mobile operators tend to block incoming traffic by default.

The firewall you see in windscribe (I use them too) is to stop your traffic from defaulting leaking back on your non-vpn connection should something happen with your connection to windscribe. It does nothing more.
 
ld13 said:
You are lucky though, in that you are using an LTE router you say? The default APN should give you some protection as the mobile operators tend to block incoming traffic by default.
Click to expand...
Great if that's the case. Using MTN's 4G fixed network.

ld13 said:
The firewall you see in windscribe (I use them too) is to stop your traffic from defaulting leaking back on your non-vpn connection should something happen with your connection to windscribe. It does nothing more.
Click to expand...
I would have thought the created wide-use tunnel is then (largely) sealed and safe, thanks for this. I only let a few essential apps use the split tunneling option.
So if that's my weakpoint, what's suggested?

1785844250382.png
 
Sapphiron said:
Once its part of a botnet, its no longer standard. Botnets will often send their own application binaries to leverage unimplemented features in the hardware.
Click to expand...
Sure, but you arent going to get full TLS inspection regardless. And if they try, it would be very noticeable from a user experience and performance perspective.
 
ld13 said:
but your network itself still interfaces the internet at your router, your front door. Nothing that windscribe can do to protect you from incoming traffic at that door.
Click to expand...
BTW do you know that Windscribe Pro includes settings for use on a router, if wanted

Routers use manual VPN configs rather than the app. Start with the WireGuard configuration generator, then import the downloaded config into your router’s VPN client section.
Click to expand...

(But even if our router was capable (doubtful, it's cheap krap) I'm not prepared to do that, want each user here making their own choices.)
 
You can always run an OPNSense IDS/IPS between your router and the rest of your network, but that does not stop your LTE router from potentially getting compromised. UFW is only applicable to that host, unless you route all your traffic through the Ubuntu box.
 
rustypup said:
Welcome to the internet

They are ALL out to get you. Behave appropriately.

DO NOT NAT, unless you have some working knowledge of what it is or what you're doing.
Click to expand...
NAT is what's protecting his LAN from the port scans. They're hitting the router and being dropped. Source NAT/PAT is what allows multiple devices on your LAN to use a single external IP, you can't avoid it.
I can only assume you meant don't port forward?

You also seem to be equating port forwarding to static NAT. Port forwarding is DNAT (port specific inbound mapping). Static NAT is a full 1:1 bidi address map.

*EDIT* I see others pointed it all out.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X