Block all connections from outside US

[xtaski]

Hi everyone, I have the latest stable 380.59 firmware running on an AC3200. I installed Merlin b/c I woke up to find 4 clients from Russia somehow connected on my 2.4Ghz radio... which is impossible because Russia is a few thousand miles away. However, it's obvious someone found an exploit so I installed Merlin.

My question is does anyone know of a way to block all IP addresses outside the US? Has anyone built a utility for this?

Thanks in advance for any help you can provide.

 

[L&LD]

How did you determine they were Russian clients?

 

[xtaski]

Well... these showed up overnight w/in 48hrs of turning on DDNS. Those internal IP addresses and MAC addresses did not correspond to anything I own that was connected to the network.

 

[xtaski]

These showed up in my connected clients overnight, within 48hrs of putting my cable modem into bridge mode and turning on DDNS. They do not correspond to any device on my network. There is no one nearby who could have spoofed them either (in the country, no neighbors near).

Screenshot attached.

 

[jeff288]

I think in pre-380.58, if you had the firewall off, the router could be accessed over WAN despite the setting. Did you also make sure to disable WAN access from SSH and network?

 

[L&LD]

Russian text does not equal Russian clients, I think?

I would recommend a full a proper reset to factory defaults followed by a minimal and manual configuration to secure your router and connect to your ISP.

http://www.snbforums.com/threads/no...l-and-manual-configuration.27115/#post-205573


I would further suggest you use new router passwords (any and all of them). Including new ssid's and new passwords for these too (and ones that can't be easily guessed either).

Turn off WAN access from ssh as jeff288 suggested and also disable WPS and WDS too.

Finally, make sure you are not giving your main ssid passwords to anyone you do not trust (immediate (adults) family), for the children in household, the guest network password is good enough.