Re: I've had one **** of a day ...

If the router is that easily compromised i would recommend a linux box
(either a VM or a low power box) with a firewall distro like ClearOS,
pfSense, IPCop, etc and have the rules there. Most of them come well
hardened by default and should withstand that kind of attacks a lot better
than a consumer router from your ISP.
I have 3 lines with 2 ISP and all of them are in "bridge mode" feeding IPs
to my linux boxes...

Best Regards,

Roberto

On Fri, Nov 14, 2014 at 1:31 PM, Jeff Bull <jeff.nyco@xxxxxxx> wrote:

I came in to work early this morning, happy and with a spring in my step .



The Firewall settings on my router had been trashed, at the same time
taking
one of my iServer Ethernet lines down. Very suspiciously, only the 'Deny
service' to IP-addresses at Chinese ISPs had been deleted.



My router has been bombarded by 'attacks' from Chinese IP-addresses for a
year now. (I look them up at http://en.utrace.de/ip-addresses/)



This happened at 03:30 this morning, and then again at 14:30 this
afternoon;
I was in the office the second time and actually watched as the firewall
entries disappeared. I changed the router login password as soon as I
suspected the problem might be there; though I am rather guessing a
back-door could be involved.



Now I've got no 'sensitive' data on my systems, client contact details is
about as bad as it gets, but I don't want them to have free access, a
matter
of principle.



Well I've re-entered the firewall entries twice today, oh, and they managed
to erase my backup too, and I'm pretty peed off I can tell you.



Does anyone know how I can keep the intruders out. I discussed this with my
ISP and the router supplier (router made in China of course) and I might as
well have been talking to them in Chinese!





Regards



Jeff

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.