[selera33]

Hi,I am have minimum knowledge on router. I want to ask about recent ransomware WannaCRY, does blocking port on router helps prevent future possible infection?
I dont use SMB or RDP so I block port 135-139,445,3389 from DD-WRT blocked services.
Does this works? Does these settings right?

Thanks.

[Alozaros]

simply add those lines in Administration>commands>firewall script

iptables -I FORWARD -p tcp --dport 137 -j DROP
iptables -I FORWARD -p udp --dport 137 -j DROP
iptables -I FORWARD -p udp --dport 138 -j DROP
iptables -I FORWARD -p tcp --dport 139 -j DROP
iptables -I FORWARD -p udp --dport 139 -j DROP
iptables -I FORWARD -p tcp --dport 445 -j DROP
iptables -I FORWARD -p udp --dport 445 -j DROP

[selera33]

[Alozaros]

they might be blocked by default but if there is an app that want to open them from inside like WCr they will be opened, but in case if there are IPtables rules those ports will remain close in any case...

[selera33]

[benbrockn]

[sploit]

Seriously?
Seriously?

How were you vulnerable to this?

Thats what you need to ask yourself in the first place.

The problem with most is failure to plan for disaster.

Weekly backups always a minimum. I mean, 5 Terabyte Hard Drives Are Cheap. Basic Backup theory.

The secondary factors is obviously you were probably using windows 7 or older. Again WHY?

Upgrade people. Remove the bloatware and telemetry and firewall your stuff. Period.

A router isnt gonna fix your problems... they are far deeper.

[Alozaros]

[Kadigan]

Okay, let's put this topic to rest:

a) the part that's vulnerable is part of Microsoft Windows services on XP/Vista/7/8/10 and the associated Server versions. Microsoft has released patches for all of these operating systems (yes, even the out-of-support ones, even XP!), so apply Windows Update or head over to their download site to download the fix (MS Security Bulletin MS17-010). There's also apparently a detection signature for Windows Defender now, too

b) lock down SMB if you wish, but only if you're sure you're not using it - if you are, but are using eg. a Linux-based server, you're not vulnerable (as of yet) and don't need this extra "protection" (the attack targets specific implementations of SMB on Windows OSes)

c) if you're not exposing SMB to the outside world (not even through VPN links), you're safe from the automated attack method from the outside world, and SMB over WAN is rarely workable enough to be a consideration (requires multiple open ports, some of which are known targets, and generally scales really, really badly with rising latency); it's a consideration if you have VPN (or other network) links set up between a place of possible infection and the place of possible attack, so you can limit forwarding on the node linking the two (it shouldn't be allowed if you're not using it, so verify your security practices)

d) as of right now, the primary infection vector is infected e-mail attachments (I'm not discounting drive-by-downloads but haven't seen reports yet), so as long as you remain vigilant and treat all attachments with due suspicion, you should be fairly safe (unless you have less-than-capable people using the same network)

e) if you want to go the extra mile, there's a Windows XP program called WannaKey that attempts to exploit a different issue with MS' crypto that leaves the prime numbers in RAM w/o explicitly cleaning them up (it attempts to fetch them and calculate the decryption key)

f) if you feel like going two extra miles, there's an experimental bit of code that runs as a .dll and claims to detect a few ransomware executions, incl. WannaCry (available as source, you have to build it yourself)


Security isn't something you deal with using iptables rules as an afterthought. For all of the people spastically scrambling to find out if they're vulnerable - shame on you. Keep your heads cool, take a step back, examine the issue and how it applies to the surfaces you expose. In most cases, if you have Windows Update active and are updating regularly, you're as safe as you're going to be - a single computer might get infected from an e-mail attachment (nothing a router can do about that), but it shouldn't spread.

One of the cornerstones of "good security practices" is "anything you don't use should be disallowed or outright disabled" (the counterpart to the principle of least privilege).

In general, your first order of business is to patch all affected Microsoft services on your network, not kill SMB traffic.


Second, --dport works with a single port. If you want multiple ports, -m multiport --dports is what you want (may not work on all distributions I suppose, but it never failed me, not even on a WRT54GL).

[benbrockn]

[fitz55]

Well here is my 2 cents, As i have owned my own computer repair shop for 20 plus years i have run into many of these type issues and the one thing that I have noticed and been told by customers is the following:
1) Why do i have antivirus software if this is not going to stop it.
2) I opened a file or Email
3) Don't have antivirus software

This can go on forever as some are educated, non educated or just enough to get by type customers. Education with such things i try to explain and document and give to my customers to try to educate them enough to try to prevent such things. I install a few programs, give them documents to explain how to run these and make it a point how important this is to do on a schedule. Here are a few programs to help with viruses, ransomware and cleanup to keep your computer running smooth. These programs are free and work wonders without any harm to your computer,files and programs.

1) CCleaner ( was known as Crap Cleaner ) cleans up all the junk,cookies and other stuff, registry clean also with backup

2) Malwarebytes - One of the best out there name says it all

3) Ransomware removal programs which pertain to the newest out such as this topic refers to and others.
a) Bitdefender Anti-Ransomware v1.0.12.151
b) Cybereason RansomFree v2.2.7.0
c) Kaspersky Anti-Ransomware Tool v1.1.31.0
d) Malwarebytes Anti-Ransomware v0.9.17.661 Beta 8

The above 4 all work great and run independent and work all with any antivirus software. Currently i am using d - Malwarebytes Anti-Ransomware v0.9.17.661 Beta 8 and works perfectly and does not slow down computer at all

So use those programs on a good schedule and a antivirus scan and you can feel at ease your computer will be safer.

REMEMBER - You need to do the scheduled maintenance as it is your valuable files you are protecting.

This is meant to help not criticize

Hope this helps all who read it. No need to block ports or put 40 different programs on the computer to stop things. Just a little maintenance