http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23741599 en Fri, 25 Mar 2022 11:15:56 EDT Fri, 25 Mar 2022 11:15:56 EDT http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23752014 said by davej :

I don't know why I have read that a NAT router is supposed to provide protection. My DSL modem provides NAT but I still saw plenty of port scans. Mostly they blindly go to 192.168.1.64 so maybe NAT does offer protection as long as you avoid using a standard address such as that one.
What makes 192.168.1.64 a "standard" IP address? You show 'swbell.net' below your avatar, so does that mean you are "at&t Yahoo! HSI" (formerly "SBC Yahoo! DSL Service"), with a SpeedStream 5100b, 4100, or 4100b modem? If so, your modem is not filtering the Internet connection to IP address 192.168.1.64. This is only standard for the ATTIS SpeedStream modems I've listed (and, maybe, some other ATTIS issued, single-user modems).

Your experience is a special case where the modem treats 192.168.1.64 similar to the typical SOHO router "DMZ".
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum]]> http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23752014 Thu, 04 Feb 2010 03:49:49 EDT http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23749523 If it is still happening so we can see if a difference is made... Give that FTP server a re-boot also and see if then it stops accepting the attempts.

fox7]]> http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23749523 Wed, 03 Feb 2010 16:41:28 EDT http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23749481 http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23749481 Wed, 03 Feb 2010 16:33:53 EDT http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23749183
I did verify that the port was un-forwarded (unchecked, then clicked Apply). After that, I watched as the login attempts continued by tailing the vsftpd.log on the FTP server, so then I restarted the router, and, after that, and, again, by tailing the vsftpd.log on the FTP server, I saw that the login attempts were still occurring.

Like I said, that (the continued login attempts after the router restart), is what is still puzzling me. I would have thought that restarting the router would have dropped all existing connections, and then, when the router came up again, would have blocked any further connections to the FTP server, but, it looks like that wasn't what was happening :(...

Jim]]> http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23749183 Wed, 03 Feb 2010 15:44:04 EDT http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23748061 said by ohaya7:

Chuck,

Yes, you're interpreting what I said accurately.

Assuming that they were maintaining a connection that they had established before I closed the port and just sending in USER and PASSWORD commands continuously, I guess I can understand that.

HOWEVER, as I said, I also, did a reboot of the Dynex, AFTER closing the port, and even after that, I STILL was seeing login attempts.

THAT'S the part of this whole thing that I don't understand.

Unfortunately, I didn't try literally unplugging the router and keeping it powered off for awhile. I should have tried that :(...

Jim


Before you reset the router any more, look in the router forwarding table, and see if the forwarding is still there.
--
Cheers,
Chuck
MS-MVP 2005-2009 [Windows - Desktop Experience]
Nitecruzr Dot Net]]> http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23748061 Wed, 03 Feb 2010 12:29:05 EDT http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23747483
Yes, you're interpreting what I said accurately.

Assuming that they were maintaining a connection that they had established before I closed the port and just sending in USER and PASSWORD commands continuously, I guess I can understand that.

HOWEVER, as I said, I also, did a reboot of the Dynex, AFTER closing the port, and even after that, I STILL was seeing login attempts.

THAT'S the part of this whole thing that I don't understand.

Unfortunately, I didn't try literally unplugging the router and keeping it powered off for awhile. I should have tried that :(...

Jim]]> http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23747483 Wed, 03 Feb 2010 10:51:50 EDT http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23746169 said by ohaya7:

Hi,

Just for now, I've set the Dynex to inactivate port 21 and to forward port 21 to an IP address on my LAN that has nothing on it, but I've also contacted Dynex support.

The Dynex seems to prevent the forwarding if the port is inactivated, and like I said, Shields Up reports all ports are Stealth, as long as I have them inactivated, but the thing that I don't understand is why it didn't prevent the login attempts even after I inactivated the port AND rebooted the Dynex.


So what you are really saying is not that the router did not prevent the login attempts (the hackers will attempt the login, no matter what you do), it is that the router did not cease forwarding the login attempts to the computer FTP port.

That's a semantic difference, but here it's relevant.

--
Cheers,
Chuck
MS-MVP 2005-2009 [Windows - Desktop Experience]
Nitecruzr Dot Net]]> http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23746169 Wed, 03 Feb 2010 01:26:51 EDT http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23742382
Just for now, I've set the Dynex to inactivate port 21 and to forward port 21 to an IP address on my LAN that has nothing on it, but I've also contacted Dynex support.

The Dynex seems to prevent the forwarding if the port is inactivated, and like I said, Shields Up reports all ports are Stealth, as long as I have them inactivated, but the thing that I don't understand is why it didn't prevent the login attempts even after I inactivated the port AND rebooted the Dynex.

I am guessing that the reason it didn't stop the login attempts after inactivating the port was that they kept doing the login attempts against an existing connection (i.e., they weren't dropping the connections between login attempts), but the thing that REALLY bothers me is why the connection wouldn't have been dropped after I rebooted the Dynex :(...

Jim]]> http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23742382 Tue, 02 Feb 2010 12:43:46 EDT http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23742194 http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23742194 Tue, 02 Feb 2010 12:12:17 EDT http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23741727
I was probably not clear. Where I was seeing the login attempts was at the FTP server, i.e., tailing the FTP server log file.

So, what I am worried about was that even though I had (supposedly) closed all ports on the Dynex wireless router, I was still seeing the login attempts at the FTP server, i.e., the connections were getting through the Dynex wireless router/NAT to my FTP server, even though the port 21 was blocked at the Dynex.

Does that clarify what I'm worried about?

Jim]]> http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23741727 Tue, 02 Feb 2010 10:54:05 EDT http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23741686 http://www.dslreports.com/forum/Re-NAT-Firewall-not-blocking-23741686 Tue, 02 Feb 2010 10:48:04 EDT http://www.dslreports.com/forum/NAT-Firewall-not-blocking-23741599
I have a Dynex wireless router (DX-WEGRTR):

»www.dynexsupport.com/pro ··· X-WEGRTR

I think that this is a re-branded Belkin product.

I normally keep all ports on the Dynex closed (all check boxes under 'Virtual Servers' unchecked), but yesterday, I had to open port 21 to have a friend download a large file from a NAS on my LAN.

During the download (which took hours), I started noticing failed log attempts (from somewhere in China, according to the IP address), and this went on all night.

So this morning, I closed port 21 on the Dynex (unchecked port 21), and clicked "Apply", but even after that, I could see the login attempts.

I even rebooted the Dynex, and ever after that, I could STILL see the login attempts.

I went to Gibson's Shields Up site, and it's showing all ports as Stealth, so, I'm wondering, what is going on?

Is the Dynex failing to block port 21? Or, am I missing something?

Thanks,
Jim]]> http://www.dslreports.com/forum/NAT-Firewall-not-blocking-23741599 Tue, 02 Feb 2010 10:36:41 EDT