Plusnet Firewall won't stay off

[#1]

I'm struggling to see how a router with a DNS bug could cause the Plusnet Broadband Firewall to "keep turning itself back on periodically".
@'mcoops82' - when you have switched the "Broadband Firewall" to "OFF" and then rebooted,  did you ever go back to the "Broadband Firewall" configuration page to check whether the "OFF" setting had been correctly applied ?, or did you only notice that it wasn't "OFF" at some later date ?.

[#2]

If one of the ports is being utilised for something that it shouldn't, then our Networks Team can take action, if required, to block that port using the Broadband Firewall.
@purleigh - See above.

[#3]

Let's try and summarise here for a minute -
There may two separate things to resolve 1) Firewall settings & Traffic 2) General poorer performance than should be, with resultant low profile if resync takes place at the wrong time (eg. when previously "rebooting" to try turning off the Firewall).
I think 2) is probably easily resolved, I'll come back to that later - it would be helpful to know who you pay line rental to - is it Plusnet or another supplier?
And yes, it is a 20CN exchange, so as you've discovered any reduction in profile takes time to recover, if it's an increase of only one profile band that will typically take 5 days if there's no intervening loss/reduction of sync. So don't do anything that will involve a loss of sync - at the current sync speed you should get a 6Mbps profile within 5 days from the last resync.
As far as 1) Let's take a step back - what provoked you to want to have the Firewall off in the first place?
There are significant advantages to having the Firewall on the Low setting if you don't need any of those Low ports incoming.
If it turns out it was purely because of some perceived performance issue, then it might be best to leave the Firewall alone for a moment and investigate the performance issue and not have Plusnet make any permanent changes at this stage.

[#4]

Just to see exactly where we are with the Profile side can you run the BTw Performance test (DON'T REBOOT, ignore the red preamble except make sure no other programs are using the Internet) and at the end of the first run, click the Further Diagnostics button, enter just your Phone number and Run the Further Diagnostics Test.
Do a Copy and Paste of the results and post here (no need to grab an image) (and not your phone number).
When you are at your computer in daylight hours, can you post more DSL stats.

[#5]

@Chris Pettitt: Firmware version of the router is 374.43 Merlin. Haven't updated it for a while as I found this to be the most stable and best firmware for wireless signal strength.
@purleigh: Any time that I have noticed the Firewall on 'Low' I have always set it to 'Off' and then left the modem until it decides to reset itself, which it does occasionally. The other morning however I did set the Firewall to 'Off', manually reboot the modem and refreshed the Plusnet firewall settings page, which then showed 'Off', so it had definitely done what I wanted it to do. I've just this second checked again and the firewall is still 'Off'.
@Anotherone: We pay line rental to Plusnet.
As I said I used to check line stats and speed tests quite often and I don't believe we've ever seen a speed higher than ~5.2Mbps (the IP profile always settles to 5 or 5.5). I've come to the conclusion that any under performance in the speed department is probably due to the age of the house and the BT wiring or something like that. I've been told by Plusnet that our line is generally very stable, apart from the times I've been trying to fix something and rebooted the modem one too many times.
Why I want the firewall off in the first place? No particular reason. I suppose I've read somewhere that too many firewalls can cause problems and I already have enabled one software firewall (Windows) and one hardware firewall (wireless router) - should be sufficient?
I always use BT wholesale speedtest and have used 'Further Diagnostics' in the past but for the longest time it has returned this message after entering my phone number and waiting: "Your speed test has completed and the results are shown above, however during the test an error occurred while trying to retrieve additional details regarding your service." I don't know exactly when or why that started happening.

I don't know whether it's of any interest but the first three or so times that the firewall turned itself back on it was accompanied by a Plusnet email telling me about the new firewall service. I turned it off after the first email but when I (some weeks) later received the same email again it made me wonder, so I checked the firewall setting and was surprised to see it back on. I assumed this was Plusnet trying to be helpful so I turned it off again. This happened at least one more time but since then I didn't receive any more emails.
By the way, I didn't want to give the impression that I was complaing about my speeds. My main reason for starting a thread was to see if anyone else cared enough to notice whether their Plusnet firewall setting was behaving itself. Since you guys have assured me that a third firewall shouldn't be a reason for speed or performance problems I'm not so concerned. I'd still rather it would stay turned off when I ask it to, though.

[#6]

Going from what Chris Pettitt has said previously, your firewall isn't just randomly turning on, it's being done quite deliberately by our networks team. It's likely they've spotted something untoward on your connection (as Chris says, some routers had issues where DNS was open meaning that anyone could use it as a DNS resolver).

[#7]

Quote from: mcoops82

Why I want the firewall off in the first place? No particular reason. I suppose I've read somewhere that too many firewalls can cause problems and I already have enabled one software firewall (Windows) and one hardware firewall (wireless router) - should be sufficient?

Ok, then forget what you've read. The only time Firewalls may give a problem is if they aren't correctly setup. The addition of the Plusnet Firewall will not cause any problems whatsoever if you do not want to use any of the incoming ports that it blocks. The low setting is usually quite satisfactory for the great majority of users and blocks a lot of un-requested traffic (some of which can be malicious) from even getting to your modem/router. That incoming traffic btw counts towards your usage, but also can clog up your connection if it's at a high level. So I'd recommend leave it on. And FYI I have 4 Firewalls running - The Plusnet one, the modem/router one, a Software one (primarily to control outgoing traffic) and the Windows one (only does incoming).
I'll respond to your other points shortly and suggest a way forward which should ensure you get a better and more stable connection. Can you post the latest stats again as well.

[#8]

Downstream Upstream
SNR Margin
:
4.0 22.0 db
Line Attenuation
:
33.0 18.5 db
Data Rate
:
7168 448 kbps
Max Rate
:
7360 1160 kbps
POWER
:
20.0 12.5 dbm
CRC
:
55160 21
@Anotherone: I guess the connection hasn't dropped since yesterday as the SNR remains lower than normal and as a result the CRC error count is really high. I'm not sure how important those particular figures are in your thought process but they are definitely not typical. I would guess that when the connection decides to drop it will come back with an SNR of around 6db and the errors normally accumulate at a much slower rate thereafter.
Thank you for the user friendly explanation of how the Plusnet firewall actually works and affects my network (or not, as the case may be). I should probably have read more about it before apportioning blame for my occasional slow speeds.
@Chris: I see, thanks for clarifying. I'll be honest, my limited technical understanding of broadband connections pretty much ends with any mention of DNS. I'll have a look in to it and see if there is any mention of DNS in the change logs for the more recent router firmware versions.

[#9]

Quote from: Chris

Going from what Chris Pettitt has said previously, your firewall isn't just randomly turning on, it's being done quite deliberately by our networks team. It's likely they've spotted something untoward on your connection (as Chris says, some routers had issues where DNS was open meaning that anyone could use it as a DNS resolver).

Surely if that happened the user would be notified! (if not, why not?)

[#10]

jelv, reply #19 does mention some emails.

Quote from: mcoops82

We pay line rental to Plusnet.

That's good, any issues we can pick up to do with the line will be more easily dealt with. I'll come back to this again.

Quote from: mcoops82

I always use BT wholesale speedtest and have used 'Further Diagnostics' in the past but for the longest time it has returned this message after entering my phone number and waiting: "Your speed test has completed and the results are shown above, however during the test an error occurred while trying to retrieve additional details regarding your service." I don't know exactly when or why that started happening.

The tester does get borked from time to time due to changes that BTw (BT Wholesale) seem to make at their end, and don't seem competent enough to test properly. If you haven't tried it recently, please try it again now if you can - BUT DON'T REBOOT as it says in the red preamble - ignore that lot, just tick the box and run the test.
I'll post some more, responding to your other points, but I'm posting this so you may wish to post in the meantime.

[#11]

@jelv: I guess the emails I was being sent were Plusnet's way of telling me they had reactivated my firewall. It didn't actually use those terms though.
If this is the case, it would have been nice to know that there was a genuine security concern behind the action.
I do think though, that if I want it off it should really stay off.
--------------------------------------
Important Notice About Your Account - Broadband Firewall Changes
To maintain a high level of service for all our customers and to provide
you with an increased level of security, we are making a small change which
affects your account.
What's happening?
To help protect you from potential security threats we have activated a
firewall for you. This will prevent unauthorised external access* to your
router. To find out more about our firewall please refer to our information
page: https://www.plus.net/support/security/firewalls/firewallfaq.shtml
What do I need to do?
You don't need to do anything. Your connection should continue to work as
normal apart from a brief disconnection whilst we make these changes.  In
the vast majority of cases your router will automatically reconnect.  If
you experience problems getting reconnected following this maintenance
please try a single reboot of your router (simply power off and on again).
If you have any concerns and would like to advice on this issue please call
us on 0800 432 0200.

[#12]

If you did want it to stay off in due course, then as was suggested before by Tony, you'd raise a ticket - did you? If so, you better have a look for any Open or Closed questions/tickets relating to it, and add a comment if it's still open (which it should be) something along the lines of "after further discussion on the forum, please leave it on for now. I'll make further comments should I require something different"

[#13]

Quote from: mcoops82

@Anotherone: I guess the connection hasn't dropped since yesterday as the SNR remains lower than normal and as a result the CRC error count is really high. I'm not sure how important those particular figures are in your thought process but they are definitely not typical. I would guess that when the connection decides to drop it will come back with an SNR of around 6db and the errors normally accumulate at a much slower rate thereafter.

The CRC count is quite important, it needs to be lower, but dealing with the causes of the SNRM being lower will alleviate that.

Quote from: mcoops82

As I said I used to check line stats and speed tests quite often and I don't believe we've ever seen a speed higher than ~5.2Mbps (the IP profile always settles to 5 or 5.5). I've come to the conclusion that any under performance in the speed department is probably due to the age of the house and the BT wiring or something like that. I've been told by Plusnet that our line is generally very stable, apart from the times I've been trying to fix something and rebooted the modem one too many times.

You are correct in your assumption that the BT wiring will most probably have something to do with that. So we'll take it one step at a time to see where we are. And in case someone else rushes along to say disconnect this and that - don't. That could very well be premature and although we may go down that path, there are other avenues to explore first - I have a plan 
Any luck with the BTw Performance test yet?

[#14]

I've tried BT wholesale speedtest recently and several times this evening before making my earlier post and it's the same every time. I never reboot, I check the box, it returns a result (presently 5.2 down, 0.38 up, 47.25 ping) but when I provide my phone number for further diagnostics it thinks for about 20 seconds while it "sends results to the server" but always fails with the message I previously quoted. It always used to work fine and gave me my IP profile etc. I never discovered why it might have stopped working.
Setting aside the re-activating firewall for a minute, as it sounds like it might be something to do with my router DNS settings. Will BT upgrade my old phone sockets/wiring? As I'm sure it's not cheap, is it worth considering or is it unlikely to yield any improvements in performance?

[#15]

Oh well, never mind the BT Tester for now, we can always get someone from CRT to check the profile in due course.
So the Firewall if definitely off at present?
The wiring - Ah, that's the "plan" bit and it depends. So let's start with the BT incoming cable. As you are out in the sticks, it's probably overhead, but you may be lucky and it's underground. If it's overhead, do you know when it was last replaced? Are there any joint boxes outside on the house?
I guess the cable will come down the side of the house - if so you've probably seen it, looked at it - is it a round cross-section cable about 5.4mm in diameter and black? Or is it a figure of 8 cross-section and flat (a bit like the old lighting flex) - it could be thin and grey, or quite chunky and black (still figure 8 ) or it may even be an oval cross-section and black?