NAT-ed Internet IP address in log?

[Justinh]

Why are "NATed" Internet/WAN IP addresses in my "System Log" > Connections > "System Log - Active Connections" ?
I don't know how to understand this, as the only NAT-ing should be for my LAN addresses, right?

example:

Proto  NATed Address            Destination Address
tcp     205.210.31.153:52439     <local IP>
tcp     198.199.118.121:50774    <local IP>
tcp     162.243.129.7:35458      <local IP>

The vast majority of the entries show <local IP> <remote IP>.

 

[ColinTaylor]

It could be almost anything. We don't know what's on your network. Looking at the destination IP address and port should give you a clue.

 

[Justinh]

Sorry to be dunce, but I'm asking how my router can be translating any Internet address ever. NAT is for all the devices on my LAN, right?

 

[ColinTaylor]

NAT is for all the devices on my LAN, right?

NAT works in both directions. So what you're seeing is a connection initiated from the internet connecting to a device on your LAN. It could be a game console, a BitTorrent program, etc. Look at System Log - Port Forwarding.

 

[ColinTaylor]

Why are "NATed" Internet/WAN IP addresses in my "System Log" > Connections > "System Log - Active Connections" ?

Either we have different firmware or the information you posted is not from the page you stated. It looks like the information from Network Tools - Netstat > Netstat-NAT (which is the same information in a different format).

EDIT: You've posted this in the AsusWRT - Official forum whereas I'm using Merlin's firmware so that's probably the difference.

EDIT 2: Yes, that was the reason for the difference.

 

[Justinh]

The page listed is correct. I have an RT-AC68U.

Okay, I have one port forwarded but no service listening on the local device at the moment. I don't know what else could cause a connection to be initiated from outside. I'll have to pay attention to the local port number next time.

Thanks for those details, helpful.

 

[ColinTaylor]

Do you have UPnP enabled? That allows devices like game consoles to dynamically open and close ports when needed.

 

[Justinh]

Nope. I don't have any gaming equipment, and there shouldn't be any torrenting going on

 

[ColinTaylor]

All three of those addresses are listed in www.abuseipdb.com. So it's likely to be port scanning. Make sure the port you've forwarded isn't a common or easily guessed one, e.g. 80, 23, 8000, 12345, etc.

 

[KevTech]

Nope. I don't have any gaming equipment, and there shouldn't be any torrenting going on

Just to clear you have disabled UPnP?
Just wondering as it is enabled by default.
It is listed on the WAN > Internet Connection tab.

 

[Justinh]

Yes, UPnP is off (at least the UI says it is).