Log History

[roldogg]

I hooked up my new RT-AC87R a couple of days ago, and ever since it's been online, the following shows up in my log history, pages and pages of it:
Aug 15 20:23:58 dropbear[9055]: Exit before auth: Disconnect received
Aug 15 20:23:59 dropbear[9056]: Child connection from 104.131.219.19:51312
Aug 15 20:23:59 dropbear[9056]: Login attempt for nonexistent user from 104.131.219.19:51312
Aug 15 20:24:00 dropbear[9056]: Login attempt for nonexistent user from 104.131.219.19:51312
Aug 15 20:24:00 dropbear[9056]: Exit before auth: Disconnect received
Aug 15 20:24:01 dropbear[9057]: Child connection from 104.131.219.19:52749
Aug 15 20:24:02 dropbear[9057]: Login attempt for nonexistent user from 104.131.219.19:52749
Aug 15 20:24:02 dropbear[9057]: Login attempt for nonexistent user from 104.131.219.19:52749
Aug 15 20:24:02 dropbear[9057]: Exit before auth: Disconnect received
Aug 15 20:24:03 dropbear[9058]: Child connection from 104.131.219.19:53588
Aug 15 20:24:04 dropbear[9058]: Login attempt for nonexistent user from 104.131.219.19:53588
Aug 15 20:24:04 dropbear[9058]: Login attempt for nonexistent user from 104.131.219.19:53588
Aug 15 20:24:05 dropbear[9058]: Exit before auth: Disconnect received
Aug 15 20:24:06 dropbear[9061]: Child connection from 104.131.219.19:55140
Aug 15 20:24:06 dropbear[9061]: Login attempt for nonexistent user from 104.131.219.19:55140
Aug 15 20:24:07 dropbear[9061]: Login attempt for nonexistent user from 104.131.219.19:55140
Aug 15 20:24:07 dropbear[9061]: Exit before auth: Disconnect received
Aug 15 20:24:08 dropbear[9062]: Child connection from 104.131.219.19:55948
Aug 15 20:24:09 dropbear[9062]: Login attempt for nonexistent user from 104.131.219.19:55948
Aug 15 20:24:09 dropbear[9062]: Login attempt for nonexistent user from 104.131.219.19:55948
Aug 15 20:24:09 dropbear[9062]: Exit before auth: Disconnect received
Aug 15 20:24:10 dropbear[9063]: Child connection from 104.131.219.19:57460
Aug 15 20:24:11 dropbear[9063]: Login attempt for nonexistent user from 104.131.219.19:57460
Aug 15 20:24:11 dropbear[9063]: Login attempt for nonexistent user from 104.131.219.19:57460
Aug 15 20:24:12 dropbear[9063]: Exit before auth: Disconnect received

I've never seen this with any of my other routers. Does anyone have a clue what's causing this?

 

[F5ing]

Do you have admin access enabled from the WAN side?

 

[RMerlin]

Disable SSH access from WAN, and make sure the firewall is enabled...

 

[roldogg]

OK. Also, when I go into VPN Status, it says Open VPN Server 1-Running. I never setup VPN access on this router. Open VPN Server 2 is stopped and Open VPN Clients 1 & 2 are stopped.

Sent from my SM-P600 using Tapatalk

 

[White_Knight]

I can confirm information about running VPN, once i upgrade FW ( before make upgrade i reset to router default )
After upgrade , when making first config i look at VPN page and VPN server 1 is running status
But in future upgrade i never see this issue with VPN server ( now i use 3.0.0.4.376.45_alpha1 compiled by me from git )

 

[ColinTaylor]

OK. Also, when I go into VPN Status, it says Open VPN Server 1-Running. I never setup VPN access on this router.

This is a known issue. When moving from ASUS firmware to Merlin or back again, the meaning of VPN1 enable/disable flag is reversed. It's not a problem, just turn it off and forget about it.

 

[roldogg]

Ok, I disabled SSH from the WAN side and disabled all access from the WAN side, like AìCloud, firewall was already on DoS was off. Haven't seen this in my log history again.