jedi98 wrote:
If your telnet port (21) is open on the wan (System Maintenance >> Management) and you do not need it available from wan then I strongly suggest that you turn it off. It will get hit all the time by bots trying to brute force in. While they may not get in they would cause you problems because only one telnet session can be active at once.
When there is another user logged in (or even at login prompt) it will not let you in and you get "System administrator is connecting from ...". So when you get that message either someone else is trying to login or it is detecting you twice somehow. I would guess, from the varying IP addresses, that someone or something else is trying to telnet in via the wan.
Thanks for quick responses. I also got a reply from Draytek: "go into router administration and enable telnet"(?!). A much better response here, thanks again.
I've noticed the problem on a LAN connection; I'm not sure about WAN (haven't used it for a while). The main purpose of enabling telnet is to enable me to make connections from anywhere in the world (although I actually do use it more frequently locally to avoid having to get up and switch a machine on ...). I switch on machines and make VPN connections, protected by the VPN password and further by the passwords to login or have access to machines on the LAN. The suggestion that the telnet login is failing because of repeated attempts to attack the network from outside is worrying; the failure to login is frequent enough to suggest sustained attacks, from different IPs. One thing I can do is look up IP addresses perhaps trying to connect and see where they are in the world, for what it's worth. I'm not going to do much testing of different access methods as the event is unpredictable: most of my connection attempts succeed. I will try connecting from two LAN locations simultaneously to see if I get the same error message.
From the management menu I see I can restrict access to stated IP addresses, which will work for local access; when travelling, if I want to take the risk I can (if I remember!) disable the restriction.
While I don't want the router to be accessed maliciously, what are the worst-case consequences? All I can see is the ability to misconfigure the router maliciously (change DNS servers, disable firewalling and so on), which can be checked by examining the setup, and corrected by restoring from a good configuration. It doesn't seem likely that password-protected machines on the LAN could be accessed. I ask this to find out, I'm not questioning the undesirability of malicious access!
Best wishes and thanks again
