[seanvree]

So, today my internet started to slow to a crawl. Checked out my logs on my DDWRT R7000, and I"m getting a lot of auth attempts from various IPs in Asia

So, two questions:
1 - How do I watch "Live" of attempted IP connections? Is this possible?

2 - since the IPs are varrying enormusly, how can I stop this?
THX

[Alozaros]

it depends where they want to log in, are they trying
your GUI or Wi-Fi ?
there are some tricks to prevent this, using iptables commands/rules...give me more details, can you identify IP's or range of IP's to block...
do you have Telnet/SSh service running....?

[seanvree]

[Per Yngve Berg]

Turn off WAN Access for the GUI

[mrjcd]

on security page enable everything under
'Impede WAN DoS/Bruteforce'
will help you some but, as mentioned you should disable remote WAN access and if you need it create an
ovpn server on this router or on one within your network to access your devices remotely.

[Alozaros]

ok then you have a few options, to filter those IP's or range of IP's or to filter port 80 for specific MAC addresses only

iptables -I INPUT -i br0 -p tcp --dport 80 -j REJECT
iptables -I INPUT -i br0 -p tcp --dport 80 -m mac --mac-source xx:xx:xx:xx:xx:xx -j ACCEPT
-------------------------------------------------------------(your allowed mac address)
do keep in mind new lines for more addresses in the same format/syntax

or

to block all range of IP's or just one IP if you want....

iptables -I INPUT -s 46.101.128.0/17 -j DROP



if you use SSh, you better do instead of Telnet...you have to choose any different than port 23 and then lock it with key file
generate it with puttygen.exe SSH-2 RSA 2048bit and use it and no access with password only connection with key-file and if you
decide key-file could be locked with pass so nobody can use it, only you...

i use those lines for hardening SSh take a note to change port 23 with your current port serving SSh

iptables -N IN_SSH
iptables -I INPUT -p tcp --dport 23 -i eth0 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 23 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 2 -j LOGDROP
iptables -A INPUT -p tcp --dport 23 -m conntrack --ctstate NEW -j IN_SSH
iptables -A IN_SSH -m recent --name sshbf --rttl --rcheck --hitcount 1 --seconds 10 -j LOGDROP
iptables -A IN_SSH -m recent --name sshbf --rttl --rcheck --hitcount 2 --seconds 1800 -j LOGDROP
iptables -A IN_SSH -m recent --name sshbf --set -j ACCEPT

you can use those lines to hardening you router too
iptables -t mangle -I PREROUTING -m conntrack --ctstate INVALID -j DROP
iptables -t mangle -I PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
iptables -t mangle -I PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
iptables -I INPUT -p tcp --tcp-flags ALL ALL -j DROP
iptables -I INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -I INPUT -f -j DROP
iptables -I INPUT -s `nvram get lan_ipaddr`/`nvram get lan_netmask` -d `nvram get wan_ipaddr` -j DROP
iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --tcp-flags RST RST -m limit --limit 2/second --limit-burst 2 -j ACCEPT
iptables -A INPUT -m recent --name portscan --rcheck --seconds 8640 -j DROP

at the end make sure you'd use strong password for GUI something with capital letters, numbers and symbols ....

[Acumen]

Well, that was a pretty quick and solid response. Where you able to keep things safe SeanVree?