NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
After installing RAX50, two NAS show hacking attempts in their logs
I installed an RAX50 to replace a ten year old Linksys WRT 1900 AC. The Linksys had nothing special in it's config and everything was running smoothly.
As soon as I put in the RAX50, traffic is getting through trying to get into both of my NAS, trying to use generic user IDs such as Admin, Root, Pi and System. Logs report the attempts are from the RAX50 (192.168.1.1). I've since blocked 192.168.1.1 on both NAS, I'm not sure if this will affect their normal operation. I don't want them accessible from the internet.
I also see thousands of login attempts (Admin & Administrator) on a PC that has a non-standard port forwarded to it for RDP.
Is the RAX50 just an unsecure piece of junk? I never had this issue with the Linksys.
Does anyone have any thoughts or advice?
My goal would be to block anything trying to access my network from the outside other than having a port open for me to RDP to one of my PCs.
Thank you,
Chris
6 Replies
CJP001 wrote:
As soon as I put in the RAX50, traffic is getting through trying to get into both of my NAS, trying to use generic user IDs such as Admin, Root, Pi and System. Logs report the attempts are from the RAX50 (192.168.1.1). I've since blocked 192.168.1.1 on both NAS, I'm not sure if this will affect their normal operation. I don't want them accessible from the internet.
What tells you that the NAS devices are accessible from the Internet?
What are the log entries in the RAX50?
Do you really want to stop your NAS from communicating with the router?
Is the RAX50 just an unsecure piece of junk? I never had this issue with the Linksys.
Netgear is famous for creating spurious and scary log entries that mean nothing. Turning off those recordings does nothing to reduce the router's protection from the outside world. Maybe your Linksys just had different logging procedures.
It's the logs from both the NAS devices that show the hacking attempts. The logs of both show repeated attempts from 192.168.1.1 (the address of the Netgear) to access them using the user IDs Admin, Root, Pi and System.
For the years that the Linksys was in place, there was never any alerts from either NAS like this.
The day after the Netgear was swapped in, both NAS devices started sending me alerts of the failed login attempts.
Also the day after the Netgear was swapped in, the event log on my Windows PC is showing thousands of failed login attempts, whereas with the Linksys, this never happened.
Everything was quiet until the Netgear was introduced.
If anything "creepy", as НolyЅtinkFinger puts it, reaches the NAS from the outside world it will have passed through the router. Maybe the logs on the RAX50 will offer some clues. Although, as already mentioned, they have a habit of creating false positives.
