DDOS Attacks

[Csection]

Is there a way to block specific addresses with X4s router?
I have been getting a lot of DDOS attacks lately.
I would like to be able to block those addresses from my router.
I used to be able to add them to a blacklist with my old Smoothwall router.

 

[System Error Message]

If you are able to access the linux bit of the router iptables will help you there.

What i do is have address lists for various things but if someone initiates a connection to the router (input) first rather than the router initiating the connection than just add to blacklist.

Unless you are a major site very likely you are getting a DDoS because a port is open on your router on the WAN side. Do a full port scan using an online tool to see what of your router or network is exposed, very likely it is something common.

 

[Csection]

Do a full port scan using an online tool to see what of your router or network is exposed, very likely it is something common.
What is the best tool for this? I have used "Shields Up", but that only does a shortlist of ports.

 

[AndreiV]

If you were getting DDOS'd your home router would be struggling to stay online.

If you are seeing lots of blocked requests in your logs from the same IP it is more likely a bot searching for open ports and your router is simply doing its job by blocking them.

Bots and back scatter fill your logs every day , adding a few IP's to a table won't change that.

 

[System Error Message]

The best thing to do is do a port scan for both TCP and UDP and also use tools to check for router vulnerabilities. There are many a few online tools but it takes a bit of searching.

 

[Csection]

The best thing to do is do a port scan for both TCP and UDP and also use tools to check for router vulnerabilities. There are many a few online tools but it takes a bit of searching.

Thanks!
I'll look for some new tools to check for open ports.

 

[sfx2000]

The best thing to do is do a port scan for both TCP and UDP and also use tools to check for router vulnerabilities. There are many a few online tools but it takes a bit of searching.

Best approach for most folks - don't open ports unless absolutely needed...

 

[Csection]

Thanks for the replies, guys!
I appreciate any help I can get!

 

[NETGEAR Guy]

DDoS is by default blocked by the firewall, so DDoS will not forward to LAN/Wireless and no need to set any specific address.

However, we may close the door, but never know who may be knocking...

 

[Csection]

DDoS is by default blocked by the firewall, so DDoS will not forward to LAN/Wireless and no need to set any specific address.

However, we may close the door, but never know who may be knocking...

Good!
I think!
I just don't have much knowledge of this and I am glad as long as you keep up with the latest security threats!

 

[System Error Message]

A lot of DDoS attacks happen mainly because something vulnerable was detected by the attacker. This is why it helps to do a port scan and vulnerability test and see what is exposed.

 

[Csection]

A lot of DDoS attacks happen mainly because something vulnerable was detected by the attacker. This is why it helps to do a port scan and vulnerability test and see what is exposed.

Thank you for the reply!
I have scanned with GRC, but I don't know a better port scanner. Can you recommend one?

 

[Csection]

Well!
With the help of Voxel. We have determined that the attacks are targeting my Arris cable modem. I am to replace the one I have with a Netgear modem to see if that fixes the problem.