topic Re: Hub Two - Firmware Update - Firewall Log in Tech Help - Software/Hardware etc

Hub Two - Firmware Update - Firewall Log

poshrat — Mon, 23 May 2022 16:41:16 GMT

Home Hub One would log / show firewall activity regarding inbound blocked attempts etc.

Home Hub Two does not appear to have this log information.

Please can this be added in the next firmware update.

It is important to be able to check for deliberate and persistent attacks especially as I have a static IP. So if for example some Russian/other party were trying to look / try exploits (and possibly succeed) we need to know so we can take the appropriate actions.

This is possibly best answered by Bob Pullen

Re: Hub Two - Firmware Update - Firewall Log

jab1 — Tue, 24 May 2022 06:43:24 GMT

@poshrat I don't know, because I don't use a Hub2, but is it not possible to select a category on this screen?:-

Re: Hub Two - Firmware Update - Firewall Log

dvorak — Tue, 24 May 2022 06:55:22 GMT

Yeah, it's the same categories as the hub1 as far as I can tell.

Re: Hub Two - Firmware Update - Firewall Log

Dan_the_Van — Tue, 24 May 2022 07:03:52 GMT

I think the complaint is are the messages being reported in the event log, the Hub One reports inbound block attempts, which I did not see when I used my Hub Two as a modem/router, I did see DoS(Port Scanning) and DoS(Spoofing) messages

Dan

Re: Hub Two - Firmware Update - Firewall Log

poshrat — Tue, 24 May 2022 08:09:51 GMT

That is correct.

Whilst you can select which category to choose ALL, MDW, WAN, PPP, LAN, WIFI, USB, QUOS, MCST, BOOT, GUI, IP, DHCP and SLAAC, BTN,TR69, FRWL, DNS and FRMU.

FRWL is I believe the Firewall Log. Here you can see DoS events and Port Scanning, UDP loopback you can not see the likes of Remote Login attempt events, blocks and others that I used to see on Hub One.

Also some of the log acronyms are a little cryptic / lack obvious meaning - most are OK.

I've established:

BTN = Button pressed event on router

But

MDW = ?

MCST = ? multicast ?

FRMU = ? looks like firmware update log

Re: Hub Two - Firmware Update - Firewall Log

Dan_the_Van — Tue, 24 May 2022 10:07:00 GMT

With the Hub One I found the number of BLOCK messages an annoyance as I really needn't need to know the firewall is working whilst enabled. But seeing port forwarding rules accepting inbound connections is important as that is where the danger exists.
Dan

Re: Hub Two - Firmware Update - Firewall Log

bobpullen — Tue, 24 May 2022 10:19:48 GMT

The Hub Two does display accepted port forwarding traffic I believe.

Being pragmatic, it's unlikley much effort will be expended to make the logging any more verbose than it currently is.

If there's something on your network that is accessible from the Internet and requires constant monitoring/protecting, then I'd strongly suggest relying on the logging/defense capability offered by the server/service/your network, rather than the events captured by a consumer router/modem.

Re: Hub Two - Firmware Update - Firewall Log

poshrat — Tue, 24 May 2022 10:59:25 GMT

OK and thanks Bob, and Dan.

Understand your point Bob. I was pointing out I guess a loss of logging function compared to Hub One.

FYI all the PCs on my network are directly firewall protected. Only two PCs can access each other over the network and both have userid and PW protection. What I can't control/protect are all these modern smart TVs etc. and should the router be breached then they are available for exploit.

I have no servers or other kit with open ports awaiting connections. Only exception to this would be a Netgear R7000 router which is not currently being used which has a VPN function hence my static IP.

I guess I/we just have to hope the Plusnet/BT keep the Hub 2 router updated with patches for known security issues. Likewise for all their older models OR replace FOC older PlusNet provided routers.

That is a potential issue with all ISP provided kit in that unlike other kit one can not get security CVE info and patches.