Can't connect to router 2 - 3 days after every reboot. (NETGEAR R6250)

[Nosiu]

Hello.

I have a problem with my router. After every router reboot I can connect to it via lan/public for only 2 - 3 days. Then there is no response from it, every service - port forwarding,WiFi, DHCP and stuff are working fine.

I had changed a few firmware's but it does not help. What can be the problem? My PC/PHONES/NAS is free of adware or viruses - checked it.

Please help!

[michaelkenward]

---

@Nosiu wrote:

After every router reboot I can connect to it via lan/public for only 2 - 3 days.

---

What does "lan/public" mean? Connecting what and how?

What firmware version do you have on the device?

A number is more useful than "the latest". (It may not be by the time people read this.) There can also be newer versions, or "hot fixes", that do not show up if you check for new firmware in the browser interface.

It might also help if you told people what the modem is in front of this router, if there is one. The model number could be useful. Is it, by any chance, also a router, with a set of LAN ports on the back?

The reason for asking is that a lot of people turn up here trying to put a router behind a modem that is also a router. That can complicate troubleshooting.

[Nosiu]

Hi.

Lan/public - I can't login on router via my browser (192.168.1.1) from my home network or neither from the Internet (remote control). After a reboot it's perfectly working fine for a few days. My previous router did not had the the problem - even if It had approx 6 months of uptime.

The version is V1.0.4.48_10.1.30. Netgear support says it's the leatest version. There is NO modem. Behind the router there is only a bunch of managed switches with SFP (don't know the network map of my ISP but it is delivering Internet to the half of city) and then the fiber going to my ISP's servers few hundred meters away from my home.

However, yesterday I saw on my routers log that I have massive connection attempts per second (bots?) from various IP's all over the world to my NAS's peer-to-peer app on one specific OPEN port. The second problem is every 5 minutes constant there are connection attempts on NAS's admin account. The router says:

[DoS attack: Smurf] attack packets in last 20 sec from ip [192.168.1.10], Tuesday, Jun 07,2022 18:53:13

[DoS attack: TCP Port Scan] attack packets in last 20 sec from ip [83.20.32.56], Tuesday, Jun 07,2022 19:29:50

Maybe this is causing the router to some kind of - 'lock itself' ? 

I am attaching the logs.

[michaelkenward]

---

@Nosiu wrote:

There is NO modem. Behind the router there is only a bunch of managed switches with SFP (don't know the network map of my ISP but it is delivering Internet to the half of city) and then the fiber going to my ISP's servers few hundred meters away from my home.

OK. That takes us into exotic network country.

Just about every ISP discussed here has either a modem or an Optical Network Terminal​ (ONT) in front of the router.

Sometimes people have a building network, and that tracks back to a router somewhere in the basement.

---

I can't login on router via my browser 

---

What happens when you try? Sadly "Can't login" does not tell us about any error messages you  may see.

This sometimes happens when your router is fighting another router to manage the connection. That's why I asked about the modem.

As to DoS Attacks, Netgear's firmware is great at creating false reports of DoS attacks. Many of them are no such thing.

Use Whois.net to see who is behind some of them and you may find that they are from places like Facebook, Google, even your ISP.

Here is a useful tool for that task:

IPNetInfo: Retrieve IP Address Information from WHOIS servers.

The IP address you mentioned, 83.20.32.56 seems to be Orange Polska S.A. Is that tour ISP? You don't say.

If these events are slowing down your router, that may be because it is using up processor time as it writes the events to your logs. Anything that uses processor power – event logging, QoS management, traffic metering – may cause slowdowns. Disable logging of DoS attacks and see if that reduces the problem. This does not prevent the router from protecting you from the outside world.

[Nosiu]

Unfortunately I don't work for my ISP and I don't see the devices they have - I am just guessing because of the measurements that the metal boxes in the basement have. 🙂 But you are right, I live in a building with approx 200 apartments.

In my apartment there is no ICT devices. The cable (UTP cat.5e - 200/200Mbit/s bandwidth) goes from my router through the concrete wall and few levels down to the basement where I assume it is connected to a switch or (as you said) router..?

[The same ISP delivers internet to my mother few kilometers out of town and yes - she has an ONT but the fibre is drawn inside the house from a concrete pole and then to the router they gave].

I'm not 100% sure but as I remember it, when I try to login on router the browser is pending and finally it gives a 'Connection Timed Out' annoucement (yesterday I rebooted it and for now it's working fine..probably tomorrow it won't - have to wait).

It's nice to hear that Netgear gives false reports which would suit me perfectly but some of the connections are the same IP, only the port is changing - could that port scanning?

The 51413 port is the ruTorrent client. I have five hundred active seeding positions but only a few active uploads a day - 3 at the moment (not as many as the connections on the router's log - hundreds per minute).

I did as you told with the IPNetInfo and you were partly right - some of the IP's are from my country (POLAND) but i checked only about 50 [lack of time].

I'm still not convinced though because of the NAS's connection attempts on admin's account which in fact did increased.

The 83.20.32.56 IP is not mine and it got me curious when the Netgear showed it. It is from my country and it's one of the biggest ISP/TV/Telecom companies in the Europe.

QoS and traffic metering are off. The router is not laggy, works fine until it stops responding.

I got an idea that I can unplug all ethernet cables and WAN from router, reboot it and leave it ON with a WiFi OFF for a few days and then check the logs or would it even let me login.

Thank you for responding.

[michaelkenward]

---

@Nosiu wrote:

Unfortunately I don't work for my ISP and I don't see the devices they have - I am just guessing because of the measurements that the metal boxes in the basement have. 🙂 But you are right, I live in a building with approx 200 apartments.

In my apartment there is no ICT devices. The cable (UTP cat.5e - 200/200Mbit/s bandwidth) goes from my router through the concrete wall and few levels down to the basement where I assume it is connected to a switch or (as you said) router..?

---

You shouldn't have to work for your (unnamed) ISP to find out how you should set up your hardware to work on its network.

---

I got an idea that I can unplug all ethernet cables and WAN from router, reboot it and leave it ON with a WiFi OFF for a few days and then check the logs or would it even let me login.

---

The issue that may cut you off after a time is when routers collide and your R6250 loses in the fight.

What is Double NAT? | Answer | NETGEAR Support

If it is connected to a router, then you could see if your own router behaves better if you put it into AP mode.

But it all comes down to how your ISP manages its network.

I assume that you have asked it how to deal with your problem.