Asus Network Service Blacklist Filter

[DaDDz66]

I got a warning from my IPS that a device on my network was infected with mirai bot, likely on a smart device. Could not tell me what device. Network is monitored and scanned with Nod32 and Malwarebytes, but as I understand it they won't pick up anything on a smart device on the network. It's using port 23 tcp. Telnet is disabled in the router settings. I'm not really clear if it can still use 23 for outgoing traffic from the device? Can I blacklist port 23 across the network in using the network service filter in my Asus AC86U? How to I get rid of this. Thanks in advance.

 

[ColinTaylor]

If you have a device on your LAN that is infected you can't use the router to stop it scanning other devices on your LAN, because the trafffic is switched not routed. However you can use the Network Services Filter to block outgoing traffic with a destination of port 23 and 2323. That would stop it infecting other people on the internet.

If you're seeing the alert in Asus' AiProtection I would have thought it should identify the source IP address?

 

[DaDDz66]

If you have a device on your LAN that is infected you can't use the router to stop it scanning other devices on your LAN, because the trafffic is switched not routed. However you can use the Network Services Filter to block outgoing traffic with a destination of port 23 and 2323. That would stop it infecting other people on the internet.

If you're seeing the alert in Asus' AiProtection I would have thought it should identify the source IP address?

Thanks for responding. Yes that's what I want to do is use Network Services Filter to block outgoing traffic. Just not clear on how I set that up in the router filter page. Do I leave everything blank and just add the the port in the form since I haven't identified the device or ip?
Only got the alert from my isp. Embarrassed to say I've never looked at the AiProtection. It's on now.

 

[ColinTaylor]

It think it should look like this. Although I don't know whether that would prevent AiProtection from detecting the infected source device (which is what you really want).

 

[ATLga]

Thanks for responding. Yes that's what I want to do is use Network Services Filter to block outgoing traffic. Just not clear on how I set that up in the router filter page. Do I leave everything blank and just add the the port in the form since I haven't identified the device or ip?
Only got the alert from my isp. Embarrassed to say I've never looked at the AiProtection. It's on now.

I wouldn’t block anything just yet. Turn on the aiprotection and find out what device it is. Then get rid of it

 

[DaDDz66]

It think it should look like this. Although I don't know whether that would prevent AiProtection from detecting the infected source device (which is what you really want).

View attachment 26753

Thanks, that's how I set it up. My primary goal was satisfying my isp so they don't disable my account. I'll have to look at how well AiProtection works at detecting Mirai?

 

[DaDDz66]

I wouldn’t block anything just yet. Turn on the aiprotection and find out what device it is. Then get rid of it

I'll disable the filter in a couple days and watch for Aiprotection to see where it is. Is it good a detecting these type of infections? Never used it or paid any attention to the feature, regretfully.