AT-RX58U Large amount of blocked incoming connections

[mattyboolin]

Hello all, apologies if I'm at the wrong place.

I recently noticed in my system log that I'm getting a ton of incoming connections that are all from (according to AbuseIPDB) malicious sources overseas. I'm not the most network-savvy individual, but I'm pretty sure that's what I'm looking at. Here's a ss of my log:

Any insight on what the deal with this is? Should I install something like skynet to ensure my network is secure? As far as I can tell they aren't trying to connect to a specific device on my network, but I could be mistaken. Thanks in advance for any help that can be offered.

 

[ColinTaylor]

Your picture is hard to read but it looks like normal internet port scanners. That's why you should turn off logging of dropped packets, it's pointless having it on.

 

[sfx2000]

Your picture is hard to read but it looks like normal internet port scanners.

Exactly - it's the internet's version of the Cosmic Background Radiation

Could be fun to just plot all of this 'traffic' as a heat map...

 

[mattyboolin]

Your picture is hard to read but it looks like normal internet port scanners. That's why you should turn off logging of dropped packets, it's pointless having it on.

Guess that really puts into perspective why you shouldn’t open up random ports. Thanks for easing my paranoia.

 

[DJones]

Guess that really puts into perspective why you shouldn’t open up random ports. Thanks for easing my paranoia.

Personally I just use skynet to geoblock most of the highest offending country’s. You’ll still receive the logs, but even if you port forward then it’ll still be a block for the scanners of those countries. CDN’s allow for local distribution within your country of popular websites. If theirs a website you need that’s blocked just whitelist it. Maybe an extreme way to firewall, but the only issue I’ve really had is when playing non steam games that host by peer to peer. People can be anywhere so geoblocking has its drawbacks. Plus side none of my cheap Chinese IoT devices directly phone home or share analytics with companies like Alibaba.

Skynet can also block by ASN most of the scanners own a ton of ip addresses, but they typically have a ASN number association even if it’s originating from a hosting company. Block the ASN and it typically blocks all ip’s from the scanner.

 

[Tech9]

Personally I just use skynet to geoblock most of the highest offending country’s.

The highest offending countries are China and USA. Brazil, India, Germany come next. All they have large Internet hubs for multiple common online services. And there are proxies, Chinese hacker may hit you via USA based server. You obviously didn't block the second largest offender for some reason. Then come your free community supported block lists with unknown reaction time. A fresh active IP is most likely not included. You basically firewalled yourself and this gives you some false sense of increased security. You also firewalled all your network users based on your understanding of things.

 

[DJones]

The highest offending countries are China and USA. Brazil, India, Germany come next. All they have large Internet hubs for multiple common online services. And there are proxies, Chinese hacker may hit you via USA based server. You obviously didn't block the second largest offender for some reason. Then come your free community supported block lists with unknown reaction time. A fresh active IP is most likely not included. You basically firewalled yourself and this gives you some false sense of increased security. You also firewalled all your network users based on your understanding of things.

Unfortunately you’re correct, I have no misunderstanding that blocking yourself in against the torrent of what is the internet is practically impossible beyond unplugging yourself from the net. Even the largest of companies that monitor all data incoming and outgoing have holes in their networks because otherwise it would negatively affect their users. Encryption makes monitoring as a man in the middle basically useless. It’s a balancing act of what is acceptable, and what is paranoid level of security. Even the best I could manage myself is hardly adequate, and merely as you say a false sense of security.

That said it’s just my home internet so really don’t care that much. My homelab is just me playing sysadmin for fun, and learning.