Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[brettar]

I can't see a Wan Section under Status/Device Info/. I only see Lan, Internet and Wireless 802.11n.

Wait the Internet section would be the Wan section right? hehe. If that's the case, then no, there's not a 192.168.0.# address in the WAN IP address field, its more like 190.14#.###.###.
So I guess the modem is bridged.

[brettar]

But right now, my believe is that the modem is being hacked through internet, through the ip adress which is on Status/Device Info/Wan Section.

I was checking the logs and I got a data that looked weird. Here's some of it:

Code: [Select]

"Mar 26 14:49:12  ","Xmas port scan attack from WAN (ip:201.218.212.175) detected."
"Mar 26 14:49:10  ","Xmas port scan attack from WAN (ip:157.55.130.171) detected."
"Mar 26 14:49:05  ","Xmas port scan attack from WAN (ip:201.218.212.175) detected."
"Mar 26 14:48:51  ","Xmas port scan attack from WAN (ip:157.55.56.143) detected."
"Mar 26 14:48:51  ","Xmas port scan attack from WAN (ip:201.218.212.175) detected."
"Mar 26 14:48:45  ","Xmas port scan attack from WAN (ip:201.218.212.175) detected."
"Mar 26 14:48:43  ","Xmas port scan attack from WAN (ip:201.218.212.175) detected."
"Mar 26 14:48:27  ","Xmas port scan attack from WAN (ip:157.55.56.143) detected."
What do you think of this data?

[FurryNutz]

The router is reporting what is going on and this is good and the firewall on the router is doing it job of blocking it or detecting it.

[brettar]

The router is reporting what is going on and this is good and the firewall on the router is doing it job of blocking it or detecting it.

But what should I do?
Even if the firewall on the router is blocking it or detecting it, I'm still having this "no access to the internet" problem.
What do you recommend?

[FurryNutz]

I would ask the ISP if there is an upgrade to this modem. I recommend getting into a stand alone modem if you can. Something with out any built in router. Ask the ISP for a new IP address on the modem as well...

• If this modem has a built in router, it's best to bridge the modem. Having 2 routers on the same line can cause connection problems: Link>Double NAT and How NAT Works. To tell if the modem is bridged or not, look at the routers web page, Status/Device Info/Wan Section, if there is a 192.168.0.# address in the WAN IP address field, then the modem is not bridged. If the modem can't be bridged then see if the modem has a DMZ option and input the IP address the router gets from the modem and put that into the modems DMZ. Also check the routers DHCP IP address maybe conflicting with the ISP modems IP address 192.168.0.1. Check to see if this is the same on the ISP modem and if modem can't be bridged. If so, change the DIR router to 192.168.1.1 or .0.254.
  Example of a D-Link router configured for PPPoE with ISP Modem bridged: PPPoE Configuration on Router

I'd test the router at a different location, say at a friends or families or nieghbor with a different ISP modem. See if the problem follows, if it does, then you'll know and go from there...

[brettar]

Ask the ISP for a new IP address on the modem as well...

Hi, I talked to the ISP, and explained them the problem I'm having. And I asked them to change the modem's IP adress. But they told me that they cannot change it like that. That the ip is generated dynamic.

Then I asked them which was the IP address that they could see from there for the modem. And they gave it to me, and when I compared it with the one located in the DIR-600 administrator web page under the Status/Device Info/Wan(Internet) section I realized it was the same.
The thing is that this ip was generated by me on that very same page doing a DHCP Release and DHCP renew. I have changed it about 4 times now recently doing some tests, giving the problems I'm having.

So, let me get this right, the Status/Device Info/Lan section displays info about the router, and the Status/Device Info/Wan(Internet) displays info about the modem? Is that correct?

I thought that this very ip address was for the router not the modem.

[FurryNutz]

Yes.

You could unplug the ISP modem and the router for say 5 minutes or more...see if the IP address on the modem gets changed...

[brettar]

Yes.

You could unplug the ISP modem and the router for say 5 minutes or more...see if the IP address on the modem gets changed...

I unplugged the ISP modem and the router for 20 minutes and the IP address on the modem did not change.

But like I said, I can generate a new ip address for the ISP modem by going to the router's web page under Status/Device Info/Wan(Internet) and clicking on the DHCP Release button and then on the DHCP renew button. I have done this several times and it always gives me a new ip adress for the ISP modem.

I don't know if this is the correct way of changing the IP address for an ISP modem though.

[FurryNutz]

As long as your getting a public IP address and it's changing then it sounds like your getting a different WAN IP address ON the router which is good..

[brettar]

As long as your getting a public IP address and it's changing then it sounds like your getting a different WAN IP address ON the router which is good..

There's is another IP address for the modem that if you access it, it shows the model of the modem, the log for the modem and other info. But this seems like a local ip to manage the modem settings.

I guess this IP address is just for administrative purposes of the modem and is not a public ip that can be changed or one that is subject to hacking from the internet right?

[brettar]

Is there a software I could use for the situation I'm having?

Like a software that monitors weird activity like this and blocks it?

[FurryNutz]

I presume there is...I don't use such SW...you might check out ComodoDragon SW.

[brettar]

I presume there is...I don't use such SW...you might check out ComodoDragon SW.

thanks.

Should I do a firmware update?
the version I have is the 2.01. The latest firmware version available is the 2.16b05.

[FurryNutz]

If the router is working well for you, I would not update it unless you have problems and the release notes state what it fixes that applies to you.

You can if you wish however please follow this for doing any FW updates:
FW Update Process

[brettar]

Hi, I haven't done a firmware update yet.
This issue hasn't been so frequent lately, but what I think is happening is a DDoS attack.
Last time it happened the router and modem crashed.
I tried to enter to the router admin web page via the router's local IP address, but I get an error saying the page is not available.
After restarting the router, I had access again.
The modem had only two lights turned on when it crashed, when it normally should have about five lights on.
The "online" light and the "link" light were off.
After restarting the modem all the lights were normal again.
So, restarting the modem and the router helped.
So, did the modem and router crashed because of the DDoS attacks?