Attack from a Chineese friend ?

[ryzhov_al]

Is there any good reason for anybody from China to access your server?

My PPTP server on RT-N66U is continuously bombed from Chinese IPs. With no reason.

So I blocked incoming connections from China with ipset. This how-to helps to reject incoming connections only, while transit traffic (from WAN to LAN clients) remains unblocked.

 

[ryzhov_al]

BTW, I've added portspoof package to Entware 1,5 years ago, still not sure somebody is using it. Should I add another IDS then?

 

[peraburek]

@ryzhov_al - your script looks promising, I would like to try it, but is there something like for Synology NAS, that I can allow one country (lets say France) and block all the rest??

Here I would have to select all the countries in the world, in this case I guess it would be better to allow IPs from "user whitelisted" countries and deny all other IPs

 

[shooter40sw]

@ryzhov_al Hi, is the IDS already in entware, are there any guides on how to use it?, dont know if it would run on a 66U?
Thanks

BTW, I've added portspoof package to Entware 1,5 years ago, still not sure somebody is using it. Should I add another IDS then?

 

[bayern1975]

My PPTP server on RT-N66U is continuously bombed from Chinese IPs. With no reason.

So I blocked incoming connections from China with ipset. This how-to helps to reject incoming connections only, while transit traffic (from WAN to LAN clients) remains unblocked.

i am tested with this and block for test slovenian country and the peer still can connect to my udpxy server? what i am doing wrong? the script seems to working but do not block incoming connection...

 

[ryzhov_al]

Hey, my router started his own twitter! https://twitter.com/home_router

… as I noticed that Australia was one of the unfriendly countries....

…So I blocked incoming connections from China with ipset.

…i am tested with this and block for test slovenian country...

Looks like hack attempts comes from every corner of the world. So, there's no sense to block specific countries.

 

[peraburek]

mega cool

Hey, my router started his own twitter! https://twitter.com/home_router

mega cool next step - add WHOIS IP to your tweet

 

[schmerg]

Hey, my router started his own twitter! https://twitter.com/home_router
Looks like hack attempts comes from every corner of the world. So, there's no sense to block specific countries.

Nice one...

mega cool
mega cool next step - add WHOIS IP to your tweet

I usually run an SSH server on port 443 externally - can sometimes help when some firewall thinks people inside should only ever be surfing the web
And that gets rid of nearly every attack (the odd port scan by my ISP now stands out).
I combine this with sslh to point genuine HTTPS connections at a known closed socket, but redirect SSH to the actual socket (this is not on my router but on a small server I run behind it, so these are ideas for cross-compiling etc rather than immediately available suggestions).

And then for my SMTP server I'm now using p0f to passively detect the OS of the source (lloks at the characteristics of the SYN+ACK), and other people have then reported success with a rule of thumb to "drop all connections from Windows when the country is other than US, UK, and your home country" (some large US mail servers still run on Windows). If nothing else, p0f might add a bit of colour ("SSH attack from a Windows XP machine in....").

 

[Maude]

Elsewhere on this forum there is a script that dynamically blocks these cases, and also blocks based on country etc. http://www.snbforums.com/threads/ho...ious-ips-using-ipset-firewall-addition.16798/
I've used this extensively, and have not seen one of these attacks since then.

Yeah, that script works fine for me as well... I adapted it to permit regular request to my website on port 80 and block them when they're coming from suspicious countries,,,

 

[BeachBum]

...but is there something like for Synology NAS, that I can allow one country (lets say France) and block all the rest...

Synology DSM has geographic region blocking built in to the firewall:
https://www.synology.com/en-us/knowledgebase/DSM/help/DSM/AdminCenter/connection_security_firewall