Re: Help needed with ORBI issue

voerman · ‎2020-03-18

Router RBR50 with firmware version V2.5.1.8 and behind a modem in bridge modus

Satelitte RBS50 with wired backhaul (cat7) and firmware V2.5.1.8

Netgear ARMOR is turned on

Since last week I am having issues with my Orbi setup and to date I haven't found a way to solve them. The problems started more or less after an software update. What happens is that the connections are more or less stable during the day but at night the wireless connections stop working. The only solution is restart all parts of the Orbi system the next day. It looks like the connection stops at 23:00 at night but not sure about that. Most of the time the router is still working ok and the satellites are offline for wifi. But sometimes the wifi of the router is stopping as well.

When I look at log files I see that I am getting Dos attacks but someone from my ISP said that could as well point at a security system not working properly. Does anybody know what I can do ?

Hope someone can help

Greets Roderick,

Here is a part of the log file

[DHCP IP: 192.168.1.14] to MAC address 18:b4:30:5e:b0:bf, Wednesday, March 18, 2020 08:00:19
[DoS Attack: ACK Scan] from source: 17.242.176.144, port 5223, Wednesday, March 18, 2020 07:57:51
[DHCP IP: 192.168.1.39] to MAC address 88:63:df:8e:35:8d, Wednesday, March 18, 2020 07:57:36
[WLAN access allowed] from MAC : 88:63:DF:8E:35:8D, Wednesday, March 18, 2020 07:57:31
[Access Control] Device IMAC-6DEALS with MAC address 88:63:DF:8E:35:8D is allowed to access , Wednesday, March 18, 2020 07:57:31
[DoS Attack: ACK Scan] from source: 34.237.198.82, port 11095, Wednesday, March 18, 2020 07:57:26
[DoS Attack: ACK Scan] from source: 3.86.149.151, port 11095, Wednesday, March 18, 2020 07:56:30
[DHCP IP: 192.168.1.26] to MAC address 14:91:82:0a:ce:ed, Wednesday, March 18, 2020 07:56:11
[DoS Attack: ACK Scan] from source: 34.195.152.165, port 11095, Wednesday, March 18, 2020 07:55:56
[WLAN access allowed] from MAC : 14:91:82:0A:CE:ED, Wednesday, March 18, 2020 07:55:40
[Access Control] Device WEMO with MAC address 14:91:82:0A:CE:ED is allowed to access the net, Wednesday, March 18, 2020 07:55:40
[DHCP IP: 192.168.1.26] to MAC address 14:91:82:0a:ce:ed, Wednesday, March 18, 2020 07:55:39
[DoS Attack: ACK Scan] from source: 34.237.198.82, port 11095, Wednesday, March 18, 2020 07:55:26
[DoS Attack: ACK Scan] from source: 3.86.149.151, port 11095, Wednesday, March 18, 2020 07:54:29
[DoS Attack: ACK Scan] from source: 34.195.152.165, port 11095, Wednesday, March 18, 2020 07:53:55
[DoS Attack: ACK Scan] from source: 34.237.198.82, port 11095, Wednesday, March 18, 2020 07:53:25
[DoS Attack: ACK Scan] from source: 3.86.149.151, port 11095, Wednesday, March 18, 2020 07:52:29
[DoS Attack: ACK Scan] from source: 3.80.102.142, port 11095, Wednesday, March 18, 2020 07:51:57
[DoS Attack: ACK Scan] from source: 34.195.152.165, port 11095, Wednesday, March 18, 2020 07:51:55
[DoS Attack: ACK Scan] from source: 34.237.198.82, port 11095, Wednesday, March 18, 2020 07:51:25
[DoS Attack: ACK Scan] from source: 18.207.62.3, port 11095, Wednesday, March 18, 2020 07:51:09
[DoS Attack: ACK Scan] from source: 3.86.149.151, port 11095, Wednesday, March 18, 2020 07:50:29
[DoS Attack: ACK Scan] from source: 3.80.102.142, port 11095, Wednesday, March 18, 2020 07:49:56
[DoS Attack: ACK Scan] from source: 34.195.152.165, port 11095, Wednesday, March 18, 2020 07:49:55
[WLAN access allowed] from MAC : 00:1D:63:04:C1:34, Wednesday, March 18, 2020 07:49:34
[DHCP IP: 192.168.1.15] to MAC address 00:1d:63:04:c1:34, Wednesday, March 18, 2020 07:49:34
[Access Control] Device MIELE-001D63FFFE04C134 with MAC address 00:1D:63:04:C1:34 is allowed, Wednesday, March 18, 2020 07:49:34
[DoS Attack: ACK Scan] from source: 34.237.198.82, port 11095, Wednesday, March 18, 2020 07:49:25
[DoS Attack: ACK Scan] from source: 18.207.62.3, port 11095, Wednesday, March 18, 2020 07:49:09
[WLAN access allowed] from MAC : 24:FC:E5:21:B4:1A, Wednesday, March 18, 2020 07:48:53
[Access Control] Device TIZEN with MAC address 24:FC:E5:21:B4:1A is allowed to access the ne, Wednesday, March 18, 2020 07:48:52
[DHCP IP: 192.168.1.10] to MAC address 24:fc:e5:21:b4:1a, Wednesday, March 18, 2020 07:48:52
[DoS Attack: ACK Scan] from source: 3.86.149.151, port 11095, Wednesday, March 18, 2020 07:48:28
[DHCP IP: 192.168.1.14] to MAC address 18:b4:30:5e:b0:bf, Wednesday, March 18, 2020 07:48:07
[DoS Attack: ACK Scan] from source: 3.80.102.142, port 11095, Wednesday, March 18, 2020 07:47:56
[DoS Attack: ACK Scan] from source: 34.195.152.165, port 11095, Wednesday, March 18, 2020 07:47:54
[WLAN access denied] from MAC : 38:D2:69:C0:1C:CF, Wednesday, March 18, 2020 07:47:54

OrbiPhilip · ‎2020-03-18

Downgrade. Several people, myself included, have had intermittent connnection issues wuith 2.5.1.8

FURRYe38 · ‎2020-03-18

What happens if you disable Armor?

Did you factory reset the RBR and RBS and setup from scratch after applying v2.5.1.8?

Use a whois to find out where those IP addresses are coming from.

@voerman wrote:
Router RBR50 with firmware version V2.5.1.8 and behind a modem in bridge modus
Satelitte RBS50 with wired backhaul (cat7) and firmware V2.5.1.8
Satelitte RBS50 with wired backhaul (cat7) and firmware V2.5.1.8
Netgear ARMOR is turned on

Since last week I am having issues with my Orbi setup and to date I haven't found a way to solve them. The problems started more or less after an software update. What happens is that the connections are more or less stable during the day but at night the wireless connections stop working. The only solution is restart all parts of the Orbi system the next day. It looks like the connection stops at 23:00 at night but not sure about that. Most of the time the router is still working ok and the satellites are offline for wifi. But sometimes the wifi of the router is stopping as well.

When I look at log files I see that I am getting Dos attacks but someone from my ISP said that could as well point at a security system not working properly. Does anybody know what I can do ?

Hope someone can help

Greets Roderick,

Here is a part of the log file

[DHCP IP: 192.168.1.14] to MAC address 18:b4:30:5e:b0:bf, Wednesday, March 18, 2020 08:00:19
[DoS Attack: ACK Scan] from source: 17.242.176.144, port 5223, Wednesday, March 18, 2020 07:57:51
[DHCP IP: 192.168.1.39] to MAC address 88:63:df:8e:35:8d, Wednesday, March 18, 2020 07:57:36
[WLAN access allowed] from MAC : 88:63:DF:8E:35:8D, Wednesday, March 18, 2020 07:57:31
[Access Control] Device IMAC-6DEALS with MAC address 88:63:DF:8E:35:8D is allowed to access , Wednesday, March 18, 2020 07:57:31
[DoS Attack: ACK Scan] from source: 34.237.198.82, port 11095, Wednesday, March 18, 2020 07:57:26
[DoS Attack: ACK Scan] from source: 3.86.149.151, port 11095, Wednesday, March 18, 2020 07:56:30
[DHCP IP: 192.168.1.26] to MAC address 14:91:82:0a:ce:ed, Wednesday, March 18, 2020 07:56:11
[DoS Attack: ACK Scan] from source: 34.195.152.165, port 11095, Wednesday, March 18, 2020 07:55:56
[WLAN access allowed] from MAC : 14:91:82:0A:CE:ED, Wednesday, March 18, 2020 07:55:40
[Access Control] Device WEMO with MAC address 14:91:82:0A:CE:ED is allowed to access the net, Wednesday, March 18, 2020 07:55:40
[DHCP IP: 192.168.1.26] to MAC address 14:91:82:0a:ce:ed, Wednesday, March 18, 2020 07:55:39
[DoS Attack: ACK Scan] from source: 34.237.198.82, port 11095, Wednesday, March 18, 2020 07:55:26
[DoS Attack: ACK Scan] from source: 3.86.149.151, port 11095, Wednesday, March 18, 2020 07:54:29
[DoS Attack: ACK Scan] from source: 34.195.152.165, port 11095, Wednesday, March 18, 2020 07:53:55
[DoS Attack: ACK Scan] from source: 34.237.198.82, port 11095, Wednesday, March 18, 2020 07:53:25
[DoS Attack: ACK Scan] from source: 3.86.149.151, port 11095, Wednesday, March 18, 2020 07:52:29
[DoS Attack: ACK Scan] from source: 3.80.102.142, port 11095, Wednesday, March 18, 2020 07:51:57
[DoS Attack: ACK Scan] from source: 34.195.152.165, port 11095, Wednesday, March 18, 2020 07:51:55
[DoS Attack: ACK Scan] from source: 34.237.198.82, port 11095, Wednesday, March 18, 2020 07:51:25
[DoS Attack: ACK Scan] from source: 18.207.62.3, port 11095, Wednesday, March 18, 2020 07:51:09
[DoS Attack: ACK Scan] from source: 3.86.149.151, port 11095, Wednesday, March 18, 2020 07:50:29
[DoS Attack: ACK Scan] from source: 3.80.102.142, port 11095, Wednesday, March 18, 2020 07:49:56
[DoS Attack: ACK Scan] from source: 34.195.152.165, port 11095, Wednesday, March 18, 2020 07:49:55
[WLAN access allowed] from MAC : 00:1D:63:04:C1:34, Wednesday, March 18, 2020 07:49:34
[DHCP IP: 192.168.1.15] to MAC address 00:1d:63:04:c1:34, Wednesday, March 18, 2020 07:49:34
[Access Control] Device MIELE-001D63FFFE04C134 with MAC address 00:1D:63:04:C1:34 is allowed, Wednesday, March 18, 2020 07:49:34
[DoS Attack: ACK Scan] from source: 34.237.198.82, port 11095, Wednesday, March 18, 2020 07:49:25
[DoS Attack: ACK Scan] from source: 18.207.62.3, port 11095, Wednesday, March 18, 2020 07:49:09
[WLAN access allowed] from MAC : 24:FC:E5:21:B4:1A, Wednesday, March 18, 2020 07:48:53
[Access Control] Device TIZEN with MAC address 24:FC:E5:21:B4:1A is allowed to access the ne, Wednesday, March 18, 2020 07:48:52
[DHCP IP: 192.168.1.10] to MAC address 24:fc:e5:21:b4:1a, Wednesday, March 18, 2020 07:48:52
[DoS Attack: ACK Scan] from source: 3.86.149.151, port 11095, Wednesday, March 18, 2020 07:48:28
[DHCP IP: 192.168.1.14] to MAC address 18:b4:30:5e:b0:bf, Wednesday, March 18, 2020 07:48:07
[DoS Attack: ACK Scan] from source: 3.80.102.142, port 11095, Wednesday, March 18, 2020 07:47:56
[DoS Attack: ACK Scan] from source: 34.195.152.165, port 11095, Wednesday, March 18, 2020 07:47:54
[WLAN access denied] from MAC : 38:D2:69:C0:1C:CF, Wednesday, March 18, 2020 07:47:54

voerman · ‎2020-03-18

Didn’t even know that is possible? How do you manage that?

voerman · ‎2020-03-18

Yes , i can but it was a **bleep** getting it to work. I am first trying the downgrade

FURRYe38 · ‎2020-03-18

Next time try a reset after a FW update to see if this helps if you encounter problems.

voerman · ‎2020-03-18

To what version should I downgrade?

FURRYe38 · ‎2020-03-18

Try v30...

voerman · ‎2020-03-23

I downgraded both satelittes and router to version V2.3.5.30. But still having wifi cut out and the satellites showing up with purple connection (no connection).

Also tried to disable armor but same result.

Any other ideas ? Should I downgrade to another version ? Please help

I consider myself lucky that I am not the guy from Netgear that signed off on a software update that makes wifi unstable just before a period WHERE EVERYBODY IS AT HOME AND NEEDS WIFI!!!!

voerman · ‎2020-03-23

what is V30 ? I have V2.3.5.30 now ? Same result. Wifi cut outs.

FURRYe38 · ‎2020-03-23

Try a factory reset on the RBS and RBR. Walk thru the setup wizard and setup from scratch to see if this helps.

Yes, v30 is same as V2.3.5.30

What is the distance between the router and satellite(s)? 30 feet is recommended in between RBR and RBS to begin with depending upon building materials when wirelessly connected. https://kb.netgear.com/000036466/How-far-should-I-place-my-Orbi-satellite-from-my-Orbi-router

What channels are you using? Auto? Try setting manual channel 1, 6 or 11 on 2.4Ghz and any unused channel on 5Ghz.
Any Wifi Neighbors near by? If so, how many?

Try enabling Beamforming and MIMO(MIMO may or maynot be needed) and WMM. Under Advanced Tab/Advanced Settings/Wireless Settings

Try disabling the following and see:
Armor, Circle, Daisy Chain, Fast Roaming, IPv6 and Set 20/40Mhz Coexistence to 40Mhz only. Set Short preamble instead of Long preamble modes. Save settings and reboot the router and satellite(s).

If you turn OFF all RBS, does the RBR still have problems with WiFi?

voerman · ‎2020-03-23

I have wired backhaul. So no wifi backhaul.

When I do a factory reset. To what version should I upgrade ? We know that v30 doesn’t work very well. Or is it different after a reset and upgrade to v30?

FURRYe38 · ‎2020-03-23

Try a reset and setup from scratch to see if reset changes anything with v30 loaded.

What is the distance between the router and satellite(s)?

Are the RBS directly connected to the RBR or is there any kind of LAN switch in between the RBS and RBR?

voerman · ‎2020-03-23

Ok will try this. Any thoughts on the sequence ? First satellites and then router ?

Satellites are connected with cat7 cable of approx 5 and 8 meter (15 -24 feet)

voerman · ‎2020-03-23

There is no lan switch orso. Direct cable connection

FURRYe38 · ‎2020-03-23

Yes, Always RBS first then RBR lastly.

Distance is ok when and if your updating FW or troubleshooting. 30 feet of more should be distances when working in normal operation. Any closer can cause problems in wifi signals with having too much wifi signal overlap between the devices.

voerman · ‎2020-03-23

I was referring to cable length. These cables go thru walls and floors so the RBS are much closer to the RBR then the cable length. Is that a problem? They have been working fine for a year orso before the last update.

Is there a way to turn wifi backhaul off altogether?

FURRYe38 · ‎2020-03-23

Ah ok. Then you should be fine then.

No you can't turn off the backhaul.

ajbacon · ‎2020-03-24

Bought a RBR50 Orbi AC3000 plus a RBS50 Orbi Satelite. Set up both according to instructions and both worked as expected, with a few performance issues. Did not maintain a record of the original FW installed. As the web interface suggested a system upgrade, clicked on it and got an upgrade to v2.5.1.8 both on the router and the satelite. The router wi-fi went into intermittent mode, coming and going every 10 or 20 seconds. The satelite just did not connect any more.

I downgraded the firmware all the way to 1.4.0.16. Intermittent wi-fi continued on the router. Went up through all the versions of firmware, same results. I only managhed to pair the Satelite when I got back to v.2.5.1.8. Each time, I went through the lengthy process of resetting to factory default and reconfiguring everything. But what with an intermittent wi-fi, it was useless.

BTW, I do have an ISP router, whose wi-fi has been turned off. My optical fiber network ISP is 240 Mbps nominal (what with Covid-19, sometimes I get 2 to 5 Mbps nowadays). I do have double-NAT, since I need specific addresses on my home network (because I hav IOT devices which would be painful to re-address).

Have given up and gone back to my previous Router.

Shall wait until Netgear manages to produce a stable FW version for the RBR50/RBS50.

FURRYe38 · ‎2020-03-24

FW may not be the poroblem since you said you've gone thru all the versions and still continue to see problems.

Did you try AP mode with the Orbi and your ISP router?

Try AP mode with your NG router you have online now.

Did you put the RBRs IP address it gets from the ISP router into the ISP routers DMZ? This would help with double NAT issues when you have two routers online the same line.

What is the distance between the router and satellite(s)? 30 feet is recommended in between RBR and RBS to begin with depending upon building materials when wirelessly connected. https://kb.netgear.com/000036466/How-far-should-I-place-my-Orbi-satellite-from-my-Orbi-router

What channels are you using? Auto? Try setting manual channel 1, 6 or 11 on 2.4Ghz and any unused channel on 5Ghz.
Any Wifi Neighbors near by? If so, how many?

Try enabling Beamforming and MIMO(MIMO may or maynot be needed) and WMM. Under Advanced Tab/Advanced Settings/Wireless Settings

Try disabling the following and see:
Armor, Circle, Daisy Chain, Fast Roaming, IPv6 and Set 20/40Mhz Coexistence to 40Mhz only. Set Short preamble instead of Long preamble modes. Save settings and reboot the router and satellite(s).

Above suggestions working:
https://community.netgear.com/t5/Orbi/Throttling-Devices-RBK53/m-p/1858561/highlight/true#M81925
https://community.netgear.com/t5/Orbi/Orbi-model-RBR50-keeps-dropping-connection-during-Zoom-calls/m...

@ajbacon wrote:
Bought a RBR50 Orbi AC3000 plus a RBS50 Orbi Satelite. Set up both according to instructions and both worked as expected, with a few performance issues. Did not maintain a record of the original FW installed. As the web interface suggested a system upgrade, clicked on it and got an upgrade to v2.5.1.8 both on the router and the satelite. The router wi-fi went into intermittent mode, coming and going every 10 or 20 seconds. The satelite just did not connect any more.
I downgraded the firmware all the way to 1.4.0.16. Intermittent wi-fi continued on the router. Went up through all the versions of firmware, same results. I only managhed to pair the Satelite when I got back to v.2.5.1.8. Each time, I went through the lengthy process of resetting to factory default and reconfiguring everything. But what with an intermittent wi-fi, it was useless.

BTW, I do have an ISP router, whose wi-fi has been turned off. My optical fiber network ISP is 240 Mbps nominal (what with Covid-19, sometimes I get 2 to 5 Mbps nowadays). I do have double-NAT, since I need specific addresses on my home network (because I hav IOT devices which would be painful to re-address).

Have given up and gone back to my previous Router.

Shall wait until Netgear manages to produce a stable FW version for the RBR50/RBS50.

Retired_Member · ‎2020-03-24

@FURRYe38 wrote:
FW may not be the poroblem since you said you've gone thru all the versions and still continue to see problems.

Once again....you're not reading the OP..

from the OP..."The problems started more or less after an software update"

voerman · ‎2020-03-25

Ok FURRYe38, I did a full reset to factory settings. Everything is back up now and looks ok. Will see if the wifi stays up during the night. What I found strange is that although I had to go thru the full setup proces as if it was a new router the installed firmware was V2.3.5.30. So the one but last version ? So I didn't have to do any updates.

I remember when the router was new I had to go thru a few firmware updates to get anyware. For instance to get wired backhaul to work.

How is this possible ?

Retired_Member · ‎2020-03-25

@voerman wrote:
Ok FURRYe38, I did a full reset to factory settings. Everything is back up now and looks ok. Will see if the wifi stays up during the night. What I found strange is that although I had to go thru the full setup proces as if it was a new router the installed firmware was V2.3.5.30. So the one but last version ? So I didn't have to do any updates.

I remember when the router was new I had to go thru a few firmware updates to get anyware. For instance to get wired backhaul to work.

How is this possible ?

but how did you get 2.5.1.8????

FURRYe38 · ‎2020-03-25

Depends on what version of FW that came in the box. Yes, there was some updates that had to be applied to get up to date and ethernet backhaul was not fully supported or working in early versions of FW.

Let us know if the wifi drops again. Please do a backup configuration to file for safe keeping. Saves time if a reset is needed again.

@voerman wrote:
Ok FURRYe38, I did a full reset to factory settings. Everything is back up now and looks ok. Will see if the wifi stays up during the night. What I found strange is that although I had to go thru the full setup proces as if it was a new router the installed firmware was V2.3.5.30. So the one but last version ? So I didn't have to do any updates.

I remember when the router was new I had to go thru a few firmware updates to get anyware. For instance to get wired backhaul to work.

How is this possible ?

voerman · ‎2020-03-30

Still the same issues after a reset to factory settings. Wifi craps out at night, and doesn't return untill a full power down power up cycle. Actually I a bit fed up with this 400 euro product that just doesn’t want to work.

Some observations:

I still find it strange that after a reset to factory settings the one but last firmware was already loaded. When it was new I had to do 2 or 3 sequential upgrades thru a few firmware versions

The wifi always stops at night. Not during the day. Could even be that it always stops working at the top of the hour and most of the time at 23:00? Maybee a time server issue?