Re: I've had one **** of a day ...

[Roberto José Etcheverry Romero <yggdrasil.raiker@xxxxxxxxx>]

If the router is that easily compromised i would recommend a linux box
(either a VM or a low power box) with a firewall distro like ClearOS,
pfSense, IPCop, etc and have the rules there. Most of them come well
hardened by default and should withstand that kind of attacks a lot better
than a consumer router from your ISP.
I have 3 lines with 2 ISP and all of them are in "bridge mode" feeding IPs
to my linux boxes...

Best Regards,

Roberto

On Fri, Nov 14, 2014 at 1:31 PM, Jeff Bull <jeff.nyco@xxxxxxx> wrote:

> I came in to work early this morning, happy and with a spring in my step .
>
>
>
> The Firewall settings on my router had been trashed, at the same time
> taking
> one of my iServer Ethernet lines down. Very suspiciously, only the 'Deny
> service' to IP-addresses at Chinese ISPs had been deleted.
>
>
>
> My router has been bombarded by 'attacks' from Chinese IP-addresses for a
> year now. (I look them up at http://en.utrace.de/ip-addresses/)
>
>
>
> This happened at 03:30 this morning, and then again at 14:30 this
> afternoon;
> I was in the office the second time and actually watched as the firewall
> entries disappeared. I changed the router login password as soon as I
> suspected the problem might be there; though I am rather guessing a
> back-door could be involved.
>
>
>
> Now I've got no 'sensitive' data on my systems, client contact details is
> about as bad as it gets, but I don't want them to have free access, a
> matter
> of principle.
>
>
>
> Well I've re-entered the firewall entries twice today, oh, and they managed
> to erase my backup too, and I'm pretty peed off I can tell you.
>
>
>
> Does anyone know how I can keep the intruders out. I discussed this with my
> ISP and the router supplier (router made in China of course) and I might as
> well have been talking to them in Chinese!
>
>
>
>
>
> Regards
>
>
>
> Jeff
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.