jedi98 wrote: Suggestions for security accessing from wan:-

• Use VPN where possible- then you don't need wan access at all


• Make sure the password is adequate


• Use HTTPS web interface where possible


• Use SSH instead of telnet, because telnet passes passwords unencrypted and so can be intercepted


• Change the default ports for ssh and telnet, the bots mainly target the defaults


• Turn off FTP

What can they do if they get in? How about redirect your DNS through a proxy so that they can redirect all your traffic to who knows where! Yes I've seen it (on an asus router which is less secure) and it really caught me by surprise.

But mainly it's just a real pain - eg. brute force attack slowing up your connection.

By the way, is there anything in the syslog that would indicate these attacks?

jedi98 wrote: I don't think there's anything useful in [syslog] for that. I use syslog but, to be honest, I find it less than useful for most things except maybe debugging (some) vpn problems.

Thanks for your response:

> The router only supports one connection session via telnet. You have
> not closed the session correctly either though the script running or
> by entering the command in the CLI window to exit the session.

> You may have closed the CLI window and the time-out session is
> activated by the router. It has timed out when you go to make another
> Telnet connection to the router it's still timing out. So since the
> first connection you made it was never closed. The time out is still
> rejecting your connection.

> You simply need to issue the command to exit and close the session.

That's absolutely not so. I connect manually only occasionally; when I do I always type "quit" to the router, and get a command prompt in the command-line windows, then close the window. The script, which I use several times a day, is:

CALL ZocTimeout 30
[connect and login to router via telnet]
CALL ZocSend "wol up 123456ABCDEF^M^J"
CALL ZocWait ">"
CALL ZocSend "quit^M^J"
CALL ZocTerminate

The critical point is that both manually and by script there is a "quit" command, which always works. I can always repeat the script immediately with no trouble now that I've restricted access to my LAN only.

> It is not china or anyone else trying to hack you.

I am virtually certain that it is. Whenever I've checked the IP address the router says the "system administrator is connecting from" it's mostly been in China. (I've had the telnet port open for access from anywhere for years, which I now see is a very bad idea. Fortunately I have a good password.) When I went into router configuration and told it only to allow management from my LAN, the problem IMMEDIATELY stopped; it never happens. My throughput shown below Diagnostics/Traffic Graph, which was an unusual 1GB/day approximately over a period (I thought is was Windows 10 updates and the like, I don't often stream or download video) has dropped to less than 100MB in the 23 hours since I last rebooted.

> Hope this helps.Let me know how you get on.

Forum users were very helpful; I will post this new information there (I hadn't reported that restricting management access to LAN addresses only completely eliminated the problem, and seems to have reduced Internet throughput and possibly got rid of slow Internet response; I'm not sure of that yet).

My issue is resolved, but if you want I can open the port to the Internet again and provide diagnostic details.