Netgear router models are RAX45-100NAS and RAX54-100NAS

Hi CrimpOn,

Sorry, I've had work & house stuff to deal with.

So, here is a map of my network.  ATT fiber thru OTN, to ATT Arris router.

From the ATT router, there are ethernet lines to:

          - Netgear router RAX45 (office)

          - 4-port switch, which feeds Netgear router R7000 and Ooma VOIP box.  (The R7000 provides wifi for my 3D printer only).

          - upstairs bonus room, but it is only used if/ when the Netgear wifi goes down.

          - Netgear router RAX 54 (living room)

RAX45 (office) provides ethernet to Desktop Black, Desktop Red, and a network printer.

RAX54 (living room) supplies ethernet to a Ring/ Eero router.  Also, all my wifi devices (cameras, smart plugs, thermostats, dehumidifiers, etc) are connected to this router.

My rationale is to keep the office NG router very pristine, minimal IoT's, and let the living room NG router be the one that carries all the wifi IoT's. 

All routers carry their individual SSID's, all use MAC filtered lists for devices.  SSID's and router access codes are changed from the MFR default codes.

Other than that, I change very little, since beyond that I know that I don't know what I'm doing.

This arrangement has worked very well for the past 2-3 years, when I added the RAX54.  Other than adding a camera or smart plug once in a while, nothing has changed.  I did verify the ATT and NG routers do automatic FW updates, and all are showing as UTD.

What began this whole science project is about 6 weeks ago, on a Tuesday at 12:30pm, got a call at work from wife and son, who both WHF full time, that the internet was down.  From work, using my phone on mobile data, I was able to access my cameras, thermostats, basically all my IoT's.  Lacking any other immediate solutions, I had son switch to the ethernet in bonus room (from ATT router) and he was back on line immediately.   I had wife reboot both the Netgear RAX45 & RAX54, and once they finished the start up routine, she was back up on the RAX 45. 

The ATT router was not rebooted.  The Ooma VOIP box never lost connectivity.  Don't know about the R7000, since I was not 3D printing during this time.

We were hoping this was just a one-off "glitch".

Following Tuesday, almost same exact time, same thing happened.  Same rebooting process.  Same again the next 4-5 Tuesdays.

Finally, Tuesday 29-July, I was WFH and watching for when this was going to happen again, and it was right on schedule.

Once the wifi went down, as evidenced by no desktop or laptop connectivity, I took my android phone and did the following queries:

(Turned off mobile data first)

1- Put phone on ATT wifi- was able to access the internet with no issues.  Also able to see my cameras, operate T'stats, interact with smart plugs, no issues.

2- Put phone on NG R7000 router-  same thing, able to access the internet with no issues.  Also able to see my cameras, operate T'stats, interact with smart plugs, no issues.

3- Put phone on NG RAX 45 - Connected/ without internet- could not interact with any of the above IoT's.

4- Put phone on NG RAX 54 - Connected/ without internet- could not interact with any of the above IoT's.

So, it appears whatever is affecting the relatively newer RAX routers is not affecting my R7000, even they both connect to the ATT router (unless the switch is doing something to filter the R7000.

Also appears that my IoT's are able to get a path thru the routers to the internet, where as long as I can get internet access on my phone, I can operate them as normal.  Seems to be just getting a computer or phone to connect to internet thru these 2 routers that becomes the problem.

Finally, rebooted both RAX 45, RAX 54, and ATT router.  All was fine until this latest Tuesday, 05-Aug.  Again, was waiting, logged in to the office RAX-45 on the admin/ logs page, all quiet until around 12:16 pm when DoS TCP SYN Flood attacks started being recorded, approx 300 lines before I lost internet connection on a browser I had open for testing.   I shut the router down and restarted.  Upon reboot, there were a few more log entries of the DoS, then everything quieted back down, and all was back to normal.

Everything is running fine now, as of Friday 08-Aug, but pretty sure this next Tuesday, it will flare up again.  

To answer one of your questions, when the router starts logging attacks, ethernet as well as wifi connectivity both drop off.  Any IoT's appear to remain connected if I get on another network that has connectivity, like mobile data or being at work.

I will need to get back to you on whether IPv6 is enabled.  I'll check all my routers and get back to you later today or tomorrow.

Sorry for the novel above, but I wanted to give you better than just half-answers....