topic Blocking Ports in Plusnet Feedback

Blocking Ports

Boz — Wed, 12 Mar 2014 16:55:32 GMT

I had a couple of emails today about Plusnet blocking ports for incoming traffic, but no indication of what time the maintenance was going to be carried out. Any chance of supplying a time?
Boz

Re: Blocking Ports

jelv — Wed, 12 Mar 2014 16:59:18 GMT

There's no general maintenance being carried out to block ports so I'm wondering if it's because PN have detected that your router has been hacked.
Could you post the full email please.

Re: Blocking Ports

LinnPlusnet — Wed, 12 Mar 2014 17:34:10 GMT

Hi Boz,
The work is due to be carried out following you receiving this notification email. It's a change that shouldn't impact your service in any way. If you do notice a change in your service then do let us know. It's account specific so this has been carried out on an account by account basis. I'm sorry if this has caused any confusion or inconvenience.

Re: Blocking Ports

Laser — Wed, 12 Mar 2014 18:01:20 GMT

I also received an email of this type. The phrasing of it made no suggestion that it was account-specific, or that the mention of compromised routers was not a general statement. (My router had indeed been compromised.) In fact I took it to be a simple enhancement of the PlusNet firewall settings.
If it was in fact a result of the compromised router, a bit more of a direct statement to that effect would have been nice...

Re: Blocking Ports

PeeGee — Thu, 13 Mar 2014 09:55:17 GMT

If it were the result of a compromised router, then
- it will be of limited (no) benefit until the device(s) is/are "cleaned"
- a clear statement of compromise should have been given
On receiving the e-mail, after checking DNS settings in all devices (I use a local DNS which forwards to opendns and plusnet, but DHCP is in the router), I ran "shields-up" from the Gibson research site, which gave a "good" result (I have now disabled the ping response that was to test TBB graphing - I have a dynamic address, not static) and all tested ports do not respond.
I did lose service yesterday evening and it was necessary to power off the modem/router to reconnect - sync was fine, but it was not possible to connect to plusnet.
Phil

Re: Blocking Ports

stephenw — Thu, 13 Mar 2014 21:50:13 GMT

It appears that port blocking has occurred on my connection, however I have not received any notification regarding it.
The "Broadband Firewall" under Connection Settings in the member centre had been set to high. I don't know what it was before but I know that I did not change it.

Re: Blocking Ports

picbits — Thu, 13 Mar 2014 22:35:01 GMT

What router do you have ?
A lot of D-Link / TP-Link / Edimax routers seem to have been compromised/hacked and Plusnet have been restricting access to certain ports when this has been detected.

Re: Blocking Ports

stephenw — Thu, 13 Mar 2014 22:50:03 GMT

I have a TG582n
dick:quote

Re: Blocking Ports

Boz — Fri, 14 Mar 2014 16:47:36 GMT

Quote from: jelv
There's no general maintenance being carried out to block ports so I'm wondering if it's because PN have detected that your router has been hacked.
Could you post the full email please.

Apologies for not getting back to you sooner. Here is the text of the email :-
"In order to us to maintain a high level of service, and protect our network against potential attacks, we need to make a change which affects your account.
This change is related to the broadband firewall which all of our customer accounts have access to.
We'll be making a change to block incoming traffic on ports 53, 111, 135, 137, 138, 139, 445, 515, 1080, 1433, 3128, 3306, 6000.
In most cases these ports will already be blocked by your local firewall however in the event of a compromised router, the ports may be unblocked or used in a potential attack.
It is unlikely you will need these inbound ports open, if you do you please visit http://contactus.plus.net and let us know by responding to this support ticket.
There's nothing you need to do, and your connection should continue to work as normal apart from a brief disconnection whilst we make these changes. In the vast majority of cases your router will automatically reconnect. If you experience problems getting reconnected following this maintenance please try a single reboot of your router."

How would I ever know whether or not I need these ports?

Re: Blocking Ports

Boz — Fri, 14 Mar 2014 16:49:59 GMT

Quote from: stephenw
It appears that port blocking has occurred on my connection, however I have not received any notification regarding it.
The "Broadband Firewall" under Connection Settings in the member centre had been set to high. I don't know what it was before but I know that I did not change it.

My setting is set to Low. Should this be changed?

Re: Blocking Ports

chrispurvey — Fri, 14 Mar 2014 16:59:47 GMT

Hi Boz,
It might be worth taking read of this this post.
Setting to low you'll probably not notice a difference anyway to your connection, it's more of a precaution.

Re: Blocking Ports

Boz — Fri, 14 Mar 2014 20:18:00 GMT

Quote from: Chris
It might be worth taking read of this this post.

Thanks for the link, Chris.
If I set up the preferred and alternate DNS addresses, as you've suggested, will this solve the problem that PlusNet has encountered ?