Re: IP Address range blocking on Orbi CBR40?

phands · ‎2019-11-11

Hi, fellow Orbi-ers,

I was looking at system logs on my Linux machine, which is connected to an Orbi CBR40 router via wifi or ethernet cable, and I see many, many connection attempts from an IP address that turns out to be from China...

inetnum:        222.184.0.0 - 222.191.255.255
netname:        CHINANET-JS
descr:          CHINANET jiangsu province network

Which is bombarding my network with hundreds of login attempts, like this....

14:51 PAM service(sshd) ignoring max retries; 5 > 3 sshd

14:51 error: maximum authentication attempts exceeded for root from 222.186.175.182 port 44942 ssh2 [preauth]

This traffic is getting through the Orbi, and is hitting other devices on my home network, so I want to stop it at the router, rather than blocking individually on 16 devices.

Because the Cable modem is built in, I can't interpose another device between it and the home wifi/wired network, and I can't see how to set up traffic blocking using an IP address or address range. I'd like to block the entire 222.184.x.x to 222.191.x.x range, not using the DNS names...is this possible on the Orbi? If so, how?

Orbi is at Firmware Version V2.3.5.12_1.0.8

Thanks,

Paul

FURRYe38 · ‎2019-11-25

I would contact your ISP and have them change the WAN IP address going to the CBR40...

@phands wrote:
Hi, fellow Orbi-ers,

I was looking at system logs on my Linux machine, which is connected to an Orbi CBR40 router via wifi or ethernet cable, and I see many, many connection attempts from an IP address that turns out to be from China...

inetnum:        222.184.0.0 - 222.191.255.255
netname:        CHINANET-JS
descr:          CHINANET jiangsu province network

Which is bombarding my network with hundreds of login attempts, like this....

14:51 PAM service(sshd) ignoring max retries; 5 > 3 sshd
14:51 error: maximum authentication attempts exceeded for root from 222.186.175.182 port 44942 ssh2 [preauth]

This traffic is getting through the Orbi, and is hitting other devices on my home network, so I want to stop it at the router, rather than blocking individually on 16 devices.
Because the Cable modem is built in, I can't interpose another device between it and the home wifi/wired network, and I can't see how to set up traffic blocking using an IP address or address range. I'd like to block the entire 222.184.x.x to 222.191.x.x range, not using the DNS names...is this possible on the Orbi? If so, how?

Orbi is at Firmware Version V2.3.5.12_1.0.8

Thanks,

Paul