AC1750 R6400 vulnerable to Mirai botnet?

Question

Hi,Since a few weeks I cannot visit certain sites as my IP adress seems to be blacklisted - a search on spamhaus confirms that my address is on the CBL (composite black list).&nbsp;Before troubleshooting I updated the firmware to the current version,&nbsp;V1.0.1.26_1.0.19. After having removed myself from the blacklist, I saw my IP address was re-added to the CBL the next day.&nbsp;According to the Netgear-logs there are DoS attacks on my router ("[DoS attack:&nbsp;Smurf] attack packets in last 20 sec from ip xxx"). I'm somewhat IT savvy, but with regard to this matter I don't know much. I basically have two questions:1) Does the fact that the router mentions the DoS attacks in its logs mean that I don't have to look further to any culprits? (I have a wireless printer and a NAS which I might look into).More importantly:2) What settings can I change on the R6400 to close the relevant outside ports for these botnets? (Supposedly ports 23,&nbsp;2323,&nbsp;3389,&nbsp;5555 and&nbsp;7547 according to abuseat). AFAIK there is no custom firewall on the R6400 router.&nbsp;Can I do anything with the Services tabpage on Security?I hope&nbsp;somebody has an idea.Cheers,Sandokanfirst&nbsp;

DexterJB · Accepted Answer

Hi sandokanfirst,

&nbsp;

1. DoS attacks on the router logs&nbsp;means that the packets were dropped.

2. The Block Services option is for outgoing services. Ports are closed unless port forwarding is done.

&nbsp;

Regards,

&nbsp;

Dexter

Community Team

Forum Discussion

AC1750 R6400 vulnerable to Mirai botnet?

2 Replies