cancel
Showing results for 
Search instead for 
Did you mean: 

Remote access attempts from around the world

hooker1uk
Newbie
Posts: 7
Registered: ‎09-05-2013

Remote access attempts from around the world

Hi all
over the last few weeks my router (Netgear n900 wndr4500) has been going sluggish at random intervals, around the same time the router logs remote lan access,
from what I understand the router is blocking it but seems to make it throw a wobbler,
has anyone else experienced this?

[Admin login] from source 192.168.1.15, Tuesday, Nov 11,2014 10:27:47
[LAN access from remote] from 184.105.139.86:55057 to 192.168.1.8:123, Tuesday, Nov 11,2014 09:41:41
[LAN access from remote] from 180.153.113.141:22205 to 192.168.1.8:1723, Tuesday, Nov 11,2014 07:46:24
[LAN access from remote] from 184.105.139.108:49865 to 192.168.1.8:123, Tuesday, Nov 11,2014 03:50:06
[LAN access from remote] from 80.85.84.75:44001 to 192.168.1.8:1723, Tuesday, Nov 11,2014 01:20:59
[LAN access from remote] from 93.180.5.26:53836 to 192.168.1.8:123, Tuesday, Nov 11,2014 01:20:56
[LAN access from remote] from 114.113.55.197:39034 to 192.168.1.8:123, Monday, Nov 10,2014 19:24:19
[LAN access from remote] from 93.180.5.26:34864 to 192.168.1.8:123, Monday, Nov 10,2014 13:50:37
[LAN access from remote] from 80.85.84.75:54001 to 192.168.1.8:1723, Monday, Nov 10,2014 07:20:40
[LAN access from remote] from 184.105.139.84:47356 to 192.168.1.8:123, Monday, Nov 10,2014 04:34:42
[LAN access from remote] from 71.6.165.200:40000 to 192.168.1.8:4500, Sunday, Nov 09,2014 20:41:35
[LAN access from remote] from 203.174.180.170:7678 to 192.168.1.8:123, Sunday, Nov 09,2014 15:01:39
[
[LAN access from remote] from 85.25.103.50:40000 to 192.168.1.8:4500, Sunday, Nov 09,2014 12:43:38
[LAN access from remote] from 93.180.5.29:35511 to 192.168.1.8:123, Sunday, Nov 09,2014 11:37:17
[LAN access from remote] from 80.85.84.75:44001 to 192.168.1.8:1723, Sunday, Nov 09,2014 08:22:20
[
[LAN access from remote] from 180.153.113.141:22201 to 192.168.1.8:1723, Sunday, Nov 09,2014 07:46:25
[LAN access from remote] from 184.105.139.80:53016 to 192.168.1.8:123, Sunday, Nov 09,2014 05:36:46
[LAN access from remote] from 210.6.40.116:18736 to 192.168.1.8:123, Saturday, Nov 08,2014 22:51:08
[Admin login] from source 192.168.1.15, Saturday, Nov 08,2014 18:37:52
[LAN access from remote] from 93.180.5.29:50594 to 192.168.1.8:123, Saturday, Nov 08,2014 16:34:38
5 REPLIES
Community Gaffer
Community Gaffer
Posts: 17,682
Thanks: 665
Fixes: 166
Registered: ‎05-04-2007

Re: Remote access attempts from around the world

All of those requests seem to looking for the same internal IP address, do you have a server or device set up on that IP address (192.168.1.8 )?
If this post resolved your issue please click the 'This fixed my problem' button
 Chris Parr
 Plusnet Staff
hooker1uk
Newbie
Posts: 7
Registered: ‎09-05-2013

Re: Remote access attempts from around the world

Hi Chris,
I've pinpointed this now to a china phone I bought the Doogee Dg300. the phone has no update options so for now I'm antivirus checking the device
Thanks, I'll update the post with the outcome
thanks
Paul
Community Veteran
Posts: 19,102
Thanks: 443
Fixes: 21
Registered: ‎31-08-2007

Re: Remote access attempts from around the world

Just to be clear, your Netgear Firewall is active I assume?
Community Veteran
Posts: 5,472
Thanks: 292
Fixes: 4
Registered: ‎11-08-2007

Re: Remote access attempts from around the world

Looking at those port numbers -
Port :123 = "NTP" (Network Time Protocol),  so those are incoming internet time packets but could be requests or replies.
Port : 1723 = "PPTP VPN" (Point-to-Point Tunneling Protocol Virtual Private Networking), which could be cause for concern if you have not set this up, as that could make your device appear on someone else's network !.
Port : 4500 = might be "NAT traversal of Internet Key Exchange in IPsec" which could be associated with the previous "PPTP VPN" port.


Some suggestions -

.

  • Update your router's firmware to the current release to eliminate security vulnerabilities discovered since manufacture, but ensure you get the correct firmware for the hardware revision you have, AND is intended for UK or European (NOT USA) routers !
.

  • Disable "UPnP" in your router and reboot, to prevent devices on your LAN opening incoming ports in you router's firewall.
.

  • You could try setting an outbound firewall rule to prevent TCP port 1723 packets leaving your network to disrupt any PPTP link.
.

  • If you think it is your phone doing this, look for the above services (NTP and VPN) and try to disable them.
.

  • Try resetting the phone to the factory defaults and see whether the problem persists.




Quote from: hooker1uk
I understand the router is blocking it but seems to make it throw a wobbler

What is the router doing other than logging blocked connection attempts ?
Does your internet connection still have sluggish periods if you leave the phone switched off ?
Does your router have a traffic graph ? where you can see the volume of data passing during these slow periods ?

Quote from: hooker1uk
has anyone else experienced this?

Everybody connected to the internet receives these kind of unsolicited connection attempts all the time, I receive as much as you listed above perhaps every 20 seconds all day every day,  however your incoming packets do look like they are targeting your phone so it would be advisable to ensure that your phone isn't initiating these connection attempts.

Wink
hooker1uk
Newbie
Posts: 7
Registered: ‎09-05-2013

Re: Remote access attempts from around the world

To update, I found the cause, well, I hope so anyway.
It turns out the dual sim Doogee dg300 I'd bought has been sending information to china using trojans domob.h domob.f and android.trojan.uupay.d which were preinstalled on purchase,
the NTP requests were due to the phone recieving that data from china! It's been changed to a uk NTP server
removal of their APK's from /system/etc/ required root but easily achievable and hopefully all gone.
the device was sending data to two locations in the US, two china and one in Thailand.
While I didn't know about the firewall option from Plusnet, until reading the reply here I've set it to low for the moment to see if it helps, my routers firewall rules seem ok for now,
UPnP is enabled right now but it'll be disabled again in the next week (well, if all goes to plan - network rebuilding is a pain in the behind, nearly as much as UPNP)
the router is up to date with the latest uk variant of the WDNR N900 router
I'll see if we get anything else since finally killing the dodgy apps.
Thanks Smiley