NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
swamprat96
Nov 16, 2022Aspirant
Orbi rbk 850 log question
I'm getting a ton of these :
[LAN access from remote] from 50.192.223.205 port 56640 to 192.168.86.179 port 2222 Wednesday, Nov 16,2022 09:45:57
[LAN access from remote] from 202.4.119.45 port 37479 to 192.168.86.179 port 2222 Wednesday, Nov 16,2022 09:45:56
I have two devices that have port forwarding to them on specific ports (SSH but not 22). The ports these entries show are not open but the target IP address it.
1. Should I be concerned about these attempts and
2. If the port is not open- how do they know these IP's exist on my network?
2 Replies
What these log entries show is that port 2222 is forwarded to 192.168.86.179.
- They do not show that there is actually a device present at 192.168.86.179.
- As an experiment, I forwarded port 80 to a non-existent device (in my case 192.168.1.150)
There was absolutely no device on my network with that IP.
However, the log almost immediately began to fill with entries about connections being forwarded to this non-existent device. - In my case, port 80 was so obvious a target, that people with nothing better to do than scan for open ports hit my public IP address attempting to connect to port 80 almost immediately. (Port 2222 is not so obvious, but there are people who scan all 65535 possible ports looking for a "hit".)
- Note that those connection requests resulted in nothing. There was no device to respond.
- As an experiment, I forwarded port 80 to a non-existent device (in my case 192.168.1.150)
- 192.168.86.x is sort of an unusual IP address. Most Orbi router set up the LAN on 192.168.1.x unless the ISP router has already taken that address.
- What is the DHCP IP space defined in this router? Is it 192.168.86.x???
- Is there actually a device present with this IP address (192.168.86.179)?
- My first step is usually to connect to Gibson Shields Up! (https://www.grc.com/x/ne.dll?bh0bkyd2 ) Select Proceed, and then select a User Specified Port Probe. (enter 2222)
I have a suspicion that Shields Up! will say that port 2222 is Stealth, meaning that nothing responded on that port. - My second step would be to double check the Port Forwarding rules to ensure that I had not set something up by accident.
- swamprat96Aspirant
Hi,
yes the DHCP is 192.168.86.10 to 254 - a leftover from a google nest wifi
Yes this is a real device- a raspberry Pi on 192.168.86.179 and I have a port forward to it - 2222. Shields up says stealth mode. So using your very helpful information I gather I'm ok? I use this device to wake up a PC remotely
Thanks
- They do not show that there is actually a device present at 192.168.86.179.