RBK40 black list external IPs

Question

Hi All,I'm wondering is it possible to black list external IP addresses ?In my router logs i can see a lot of "failed login" attempts (in hundreds). I can stop the remote management funtion, but it is good to have it working.Also a can see a lot of DoS attacks.&nbsp;Thnaks.&nbsp;

CrimpOn · Answer

Stimar&nbsp;wrote:I'm wondering is it possible to black list external IP addresses ?In my router logs i can see a lot of "failed login" attempts (in hundreds). I can stop the remote management funtion, but it is good to have it working.&nbsp;There are two alternative ways to manage an Orbi remotely, which will eliminate the "failed login" attempts:The Orbi "app" provides the typical "cloud" pathway where the Orbi opens a link to Netgear's cloud system and the app uses this link to reach the Orbi.&nbsp; This is what is used for the bulk of the Internet of Things (IoT).&nbsp; For me, although the "app" is shiny and modern, I find that most of what I want to do on the Orbi requires either web or telnet access.Set up VPN.&nbsp; Once a Dynamic DNS and VPN (they go together) are configured, it is possible to reach the Orbi from the internet through the VPN and access the web interface or telnet into the Orbi.&nbsp; This is not a trivial exerciseOne of my "suggestions" to Netgear is to show what password was entered in the failed attempt so that the user can determine what sort of attack is being conducted.&nbsp; i.e. Is it a list of common passwords?&nbsp; Are they enumerating all possible passwords starting with "aaaaa"?&nbsp; In my case, my 25 character string of words, numbers, and punctuation is likely to withstand attack well into the next century.

Stimar · Answer

Hi All&nbsp;CrimpOnThanks for the suggestion that you made, about the strong password - this is correct but sometime attackers are exploiting vulnerabilities which are independent from the password it self.&nbsp;Most time problems come from within. IoT devices for example are more prone to attacks since they are not regularly updated or no updated at all which pose a risks.&nbsp;The question would be - will NetGear add new feature - blacklist, which will be firewall improvement.

CrimpOn · Answer

I am not aware of any mechanism to blacklist specific IP addresses. Even if there were, my guess is that this would be similar to me blocking robocalls. Since they spoof telephone numbers, I can add a block after every call that comes in and they just keep picking new telephone numbers to spoof.

I take solace that the log is reporting attempts that the Orbi detected and repulsed. It's just a reminder that we do not want our devices exposed to the internet if we can help it.

FURRYe38 · Answer

What Firmware is currently loaded?What is the Mfr and model# of the ISP modem the NG router is connected too?&nbsp;Most routers firewall are good enough to block problems like this. The logs are just reporting that the firewall is doing it's job.&nbsp;&nbsp;Contact your ISP and have them help you change the WAN IP address that is given to you by your ISP.&nbsp;&nbsp;Besure that respond to WAN pings is disabled.&nbsp;Do you have Remote Management enabled on the RBR? If you don't need this, disable this feature.&nbsp;

Stimar · Answer

Hi All,My&nbsp; Orbi FW is the lattest one, my IP is dynamic one. I'm haveing one small ISP router (which is spliting the internet and the TV) before Orbi on which i don't have access anyway.I'm concerned about the DoS attack, the problem here is that someone is trying to brute force my password. That's why we can see so much failed login attempts and the goal here is to have remote access to my switch, but to be able to block external IPs.

Forum Discussion

RBK40 black list external IPs

8 Replies