NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
orbi network turn of by dos attack
Hi, My orbi system turn off a view time's a week. When I take a look at the log file there is a dos attack standing on that time. I'm using: firmware version 2.3.5.30 orbi system RBR50 can s...
What is the Mfr and model# of the ISP modem the NG router is connected too? Built in router here by chance?
You might update to v2.5.1.8, factory reset and setup from scratch and see if this changes anything.
Z190mn wrote:I did a reinstall last weekend but today there was the same problem as before.
So the problem is still there.
I did the factory reset a view weeks ago. after that I did the firmware update to v2.5.1.8.
But there is still the same problem that the orbi system reboot a view times a week. knows someone a fix for this problem?
What is the Mfr and model# of the ISP modem the NG router is connected too? Built in router here by chance?
Any Wifi Neighbors near by? If so, how many?
We have a modem from a dutch provider. And the modem is in bridge mode.
This is an URL to the specifications: https://nl.hardware.info/routers.9/compal-ch7465lg-zg-ziggo-connect-box.371250
There are a view other wifi connections nearby, but if I check this on my phone I count 4. So I don't think that's the problem.
I would try this:
Configure the ISP modem back to router mode. Disable all wifi radios on the modem and connect the Orbi router to the modem, configure AP mode on the Orbi router. https://kb.netgear.com/31218/How-do-I-configure-my-Orbi-router-to-act-as-an-access-point and https://www.youtube.com/watch?v=H7LOcJ8GdDo&app=desktop
I tried what you just said. This works good for a view days but after that the orbi had the same problem as before.
So I don't think that this is the good solution.
Have you changed the WiFi SSID and Pasword on the RBR?
Seems like something is going after the Orbi or there is some interferences.
What channels are you using? Auto? Try setting manual channel 1, 6 or 11 on 2.4Ghz and any unused channel on 5Ghz.
Any Wifi Neighbors near by? If so, how many?Try enabling Beamforming and MIMO(MIMO may or maynot be needed) and WMM. Under Advanced Tab/Advanced Settings/Wireless Settings
Try disabling the following and see:
Armor, Circle, Daisy Chain, Fast Roaming, IPv6 and Set 20/40Mhz Coexistence to 40Mhz only. Save settings and reboot the router and satellite(s).Above suggestions working:
https://community.netgear.com/t5/Orbi/Throttling-Devices-RBK53/m-p/1858561/highlight/true#M81925sorry for the delay.
I have tried but non of the things are working. :(
I had taked a look for all the channels what my neighbors but there are a view different channels.
You may want to contact NG support.
I have the same problems with a simular setup both in router and DHCP mode.
Firmware Version V2.5.1.8 The router resets several times a day, the only logging is a dos attack.
What is the Mfr and model# of the ISP modem the NG router is connected too?
Has a factory reset and setup from scratch been performed since last FW update? Try this.
Reboot or power cycle all network devices as well after the reset.
Power OFF the ISP modem for 1 minute then back ON and then setup the RBR.
Spider4 wrote:I have the same problems with a simular setup both in router and DHCP mode.
Firmware Version V2.5.1.8 The router resets several times a day, the only logging is a dos attack.
The netgear orbi router RBR50v2 is connected to Eurodocsis 3.0 modem.
I did factory reset of router and modem, to test the setup in orbi in router and dhcp mode.
The result is both negative.
Where are these attacks coming from? Is the IP addresses a external address or an internal address?
Try downloading v30 FW on the RBR to see if this changes anything...
Spider4 wrote:The netgear orbi router RBR50v2 is connected to Eurodocsis 3.0 modem.
I did factory reset of router and modem, to test the setup in orbi in router and dhcp mode.
The result is both negative.
example: in DHCP mode
[DOS Attack: RST Scan] from 151.139.242.13, port 443 ......
[DOS Attack: ACK Scan] from 212.123.200.220, port 220 ......
[DOS Attack: ACK Scan] from 212.123.200.220, port 220 ......
example: in router mode
[DOS Attack: RST Scan] from 17.179.252.32, port 443 ......
sorry 2 typo's in the port; port is always 443
example: in DHCP mode
[DOS Attack: RST Scan] from 151.139.242.13, port 443 ......
[DOS Attack: ACK Scan] from 212.123.200.220, port 443 ......
[DOS Attack: ACK Scan] from 212.123.200.220, port 443 ......
example: in router mode
[DOS Attack: RST Scan] from 17.179.252.32, port 443 ......
You might check those IPs with a whois web site.
Ask your ISP to give you a different WAN IP address to see if the attacks stop.
I have asked for the helpdesk for support and after a clean installation all works again.