cancel
Showing results for 
Search instead for 
Did you mean: 

Router blocking packets and IPs like crazy - Need help

Thomas5020
Grafter
Posts: 49
Thanks: 2
Fixes: 2
Registered: ‎29-06-2016

Router blocking packets and IPs like crazy - Need help

So for the past few days I've been having issues with connection stability and speed. Every time I'm having problems, when I check my router logs I see loads of this:

IN: BLOCK [15] Default policy (TCP [216.58.208.170]:443-​>[147.147.23.103]:48792 on ppp3)

IN: BLOCK [9] Packet invalid in connection (Invalid tcp flags for current tcp state: TCP [216.58.206.131]:80-​>[147.147.23.103]:37769 on ppp3)
IN: BLOCK [16] Remote administration (TCP [46.1.242.188]:37483-​>[147.147.23.103]:80 on ppp3)

Have also been getting some with "TCP Reset Attack suspected" although none right now. 

The IP's that have been attempting inbound connections aren't from anything I'd be communicating with, they just seem to be random IP's from various countries and from what I've seen they've been reported quite a lot on various sites. First day it was happening the amount of inbound stuff that was being blocked the router became unresponsive quite a few times

Also been getting a similar thing for outbound connections, but much much less often. 

Any ideas what's going on here? I understand it's blocking packets and communications from certain IP's, but I don't get why? Am I being port scanned or something? 

 

1 REPLY 1
dws1900
Aspiring Pro
Posts: 407
Thanks: 51
Fixes: 2
Registered: ‎17-09-2018

Re: Router blocking packets and IPs like crazy - Need help

@Thomas5020

 

The ip address in your post

https://www.abuseipdb.com/check/216.58.208.170

belongs to google, and has been subject to a number of issues.

 

The ip address 46.1.242.188 is in Turkey

https://www.abuseipdb.com is a site to look up ip addresses to see if they have been used for attacks.

These attacks are happening all the time, not all internet users play nice Sad