What's new
By:

Remote ssh attempts even though ssh is “LAN only”

T

table45

New Around Here
Hi all!

Experienced sysadmin here, but not a router expert.

TL;DR – My TUF-BE3600 had system log entries (bad password/no such user account) for a Vietnamese IP address attempting to SSH in, BUT remote/WAN SSH access is disabled, the firewall is enabled, and I can't remotely SSH access to it myself, so is there a setup issue or is it a bug?

Background
Woke up to my home internet being unresponsive. Wifi was up but no websites or apps could connect. Bounced wifi on my phone then rebooted the phone and still not working so I switched to looking at the router - instead of rebooting it decided to check it out first because why not.
  • I could connect to the router via its local wifi network using the ASUS app and web interface
  • I could also connect to it (with the app only) via mobile data
  • Devices connected to the router couldn't connect to any internet sites
  • On the router itself I could ping google, do dns lookups etc so its internet connection was working
  • While doing all the above I then happened to notice unexpected things as per below.
  • It all starting working again as soon as I rebooted the router
The weirdness I found before rebooting
Netstat ơn the router listed a connection on port 22 (SSH) from vietnam, (and also two connections to AWS EC2 instances that I figure are the remote connection to ASUS for remote management via the app):

tcp 115-xxxxmywanip.ip4.superloop.au:ssh dynamic-ip-adsl.viettel.vn:35916
tcp 115-xxxxmywanip.ip4.superloop.au:54202 ec2-54-200-198-224. us-west-2.compute.amaz...
tcp 115-xxxmywanip.ip4.superloop.au:42033 ec2-54-169-185-136. ap-southeast-1.ap-southeast-1.compu...
Click to expand...

The ssh connection was only there for a few seconds as it was gone the next time I ran netstat.

In the router's system.log at the same time you can see me successfully connecting to the router with my iPhone at 9:55:25 followed shortly after by a bad password attempt from 171.243.149.253 (which resolves to dynamic-ip-adsl.viettel.vn to match what was seen in netstat), followed by some login attempts for nonexistent users (wasn't me of course):

Jan 31 09:55:25 HTTPD: [LOGIN][https][APP] successed (192.168.50.144) [me from my phone]
Jan 31 09:55:32 dropbear[3483]: Bad password attempt for 'admin' from 171.243.149.253:40852
Jan 31 09:55:40 rc_service: httpds 3963:notify_rc start_webs_update
Jan 31 09:55:41 dropbear[3498]: Login attempt for nonexistent user
Jan 31 09:56:00 dropbear[3516]: Login attempt for nonexistent user
Jan 31 09:56:00 dropbear[3517]: Login attempt for nonexistent user
Jan 31 09:56:31 dropbear[3697]: Login attempt for nonexistent user
Jan 31 09:56:46 dropbear[3699]: Login attempt for nonexistent user
Click to expand...

Over the last 10 days of logs, the ONLY other dropbear events are successful logins for me connecting via its local Wifi 192.168.50.0 network. I guess the timing of me logging in to see what was broken, with this attempt was just a really massive coincidence (?). Happily the router admin password is unique, long, and randomly generated as are all my passwords.

But...correct me if I'm wrong, this shouldn't be happening!
  • "Enable SSH" was set to "LAN only"! --> It shouldn't be allowing remote connections
  • Router firewall was enabled

After the reboot I checked the following:
  • A remote port scan using online port scanners doesn't find any open ports on my public IP4 address, and trying to SSH in remotely doesn't work either (it times out)
  • I then changed “Enable SSH” to "LAN and WAN" and only then could I SSH to my router remotely (have changed it back of course), and I could see this router firewall rule appear and disappear "-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT" during this test
  • SSH port was still default of 22
  • There's no authorised SSH keys set up
  • Unrelated, but "Enable Web Access from WAN" is "No"
  • Firmware is still on latest version
The router is only about a month old, and I patched it straight away when I bought it.

So…how did this happen??
 
FWIW below is a dump of the firewall rules, which I haven’t customised and by my review would block inbound ssh to the router.
[some log/output rules removed to stay under character limit]

Code: 
admin@TUF-BE3600-DC58:/tmp/home/root# iptables -vnL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   23  1501 URLFI      udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 INPUT_PING  icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
  163 30645 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    1    44 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
  169 36497 PTCSRVWAN  all  --  !br0   *       0.0.0.0/0            0.0.0.0/0           
   31  2746 PTCSRVLAN  all  --  br0    *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       tcp  --  !lo    *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5152
   31  2746 ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0            state NEW
  148 35561 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0            state NEW
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:67 dpt:68
    0     0 INPUT_ICMP  icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
   21   936 WGSI       all  --  *      *       0.0.0.0/0            0.0.0.0/0           
   21   936 WGCI       all  --  *      *       0.0.0.0/0            0.0.0.0/0           
   21   936 OVPNSI     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
   21   936 OVPNCI     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
   21   936 SDN_FI     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
   21   936 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  348  149K NWFF       all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  348  149K URLFF      all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  348  149K IPSEC_DROP_SUBNET_ICMP  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  348  149K IPSECSSDN  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  348  149K IPSEC_STRONGSWAN  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
   62  3856 TCPMSS     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x06/0x02 TCPMSS clamp to PMTU
  312  141K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
   36  7694 WGSF       all  --  *      *       0.0.0.0/0            0.0.0.0/0           
   36  7694 OVPNSF     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  br0    br0     0.0.0.0/0            0.0.0.0/0           
    1    40 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT
    0     0 DNSFILTER_DOT  tcp  --  br+    *       0.0.0.0/0            0.0.0.0/0            tcp dpt:853
   35  7654 WGCF       all  --  *      *       0.0.0.0/0            0.0.0.0/0           
   35  7654 OVPNCF     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
   35  7654 VPNCF      all  --  *      *       0.0.0.0/0            0.0.0.0/0           
   35  7654 SDN_FF     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 397 packets, 67754 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   89  6368 OUTPUT_DNS  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 u32 "0x0>>0x16&0x3c@0x8>>0xf&0x1=0x0"
    0     0 OUTPUT_DNS  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53 u32 "0x0>>0x16&0x3c@0xc>>0x1a&0x3c@0x8>>0xf&0x1=0x0"
  424 70477 OUTPUT_IP  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain ACCESS_RESTRICTION (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain DNSFILTER_DOT (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain FUPNP (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain IControls (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT_ICMP (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
    0     0 RETURN     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 13
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain INPUT_PING (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       icmp --  eth0   *       0.0.0.0/0            0.0.0.0/0           

Chain IPSECSSDN (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain IPSEC_DROP_SUBNET_ICMP (1 references)
 pkts bytes target     prot opt in     out     source               destination         


Chain OUTPUT_IP (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 logdrop_ip  all  --  *      *       0.0.0.0/0            193.201.224.0/24    
    0     0 logdrop_ip  all  --  *      *       0.0.0.0/0            51.15.120.245       
    0     0 logdrop_ip  all  --  *      *       0.0.0.0/0            45.33.73.134        
    0     0 logdrop_ip  all  --  *      *       0.0.0.0/0            190.115.18.28       
    0     0 logdrop_ip  all  --  *      *       0.0.0.0/0            51.159.52.250       
    0     0 logdrop_ip  all  --  *      *       0.0.0.0/0            190.115.18.86       

Chain OVPNCF (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain OVPNCI (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain OVPNSF (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain OVPNSI (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain PControls (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain PTCSRVLAN (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain PTCSRVWAN (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain SDN_FF (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  br55   eth0    0.0.0.0/0            0.0.0.0/0           
   35  7654 ACCEPT     all  --  br0    eth0    0.0.0.0/0            0.0.0.0/0           
    0     0 SDN_IA     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain SDN_FI (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     udp  --  br55   *       0.0.0.0/0            0.0.0.0/0            multiport dports 53,67,68
    0     0 DROP       all  --  br55   *       0.0.0.0/0            192.168.50.1        
    0     0 ACCEPT     all  --  br55   *       0.0.0.0/0            0.0.0.0/0            state NEW

Chain SDN_IA (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  br+    br+     0.0.0.0/0            0.0.0.0/0           


Chain URLFF (1 references)
 pkts bytes target     prot opt in     out     source               destination         
      

Chain URLFI (1 references)
 pkts bytes target     prot opt in     out     source               destination         



           
admin@TUF-BE3600-DC58:/tmp/home/root#
 
Your firewall rules look OK, but I'm guessing they were dumped after you rebooted the router and the problem went way?

One thing that confused me, you said "I could also connect to it (with the app only) via mobile data". So are you saying that the router is accessible from the internet using the app?

Another frequent cause for concern is AiCloud. Have you ever enabled that?
 
table45 said:
  • I could also connect to it (with the app only) via mobile data
Click to expand...
Typically if you can access your Asus router using the Asus app from outside the local network (i.e. using mobile data not WiFi) that indicates you have enabled the remote access features of the router. Those features typically require ports or services to be open on the router's WAN side so the app can access the router remotely.
[Wireless Router] How to set up ASUS wireless router to access WebGUI/Router App from WAN?

If using the Asus app, check that the Settings > System Settings > Remote Access option is disabled (turned off).
From the router GUI, see Administration > System > Remote Access Config. Ensure the option(s) Enable Web Access from WAN is disabled.
Double check that if you haven enabled SSH that it is configured for LAN Only.

If you have any other features enabled that are accessible from the router's WAN side, like AiCloud, Alexa support, or any sort of USB device access, make sure to disable them. AiCloud has been repeatedly patched by Asus due to it apparently being an intrusion access point for malware. With remote features disabled, check to see if the issue persists or repeats.
 
Last edited:
You must log in or register to reply here.

Similar threads

S
SSH password auth suddenly stops working for admin user
Replies
0
Views
331
Samosa
S
I
dropbear[...]: Login attempt for nonexistent user from [External IP]
Replies
19
Views
2K
dave14305
dave14305
P
[Security] SSH port opened to WAN even though "Enable SSH" is set to "LAN only"
Replies
3
Views
950
Viktor Jaep
Viktor Jaep
joegreat
OpenVPN error/warning "write UDPv4: No buffer space available"
Replies
18
Views
990
joegreat
joegreat
RMerlin
Release Asuswrt-Merlin 3004.388.10 is now available
15 16 17
Replies
324
Views
47K
nabice
N

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 3,029 (members: 15, guests: 3,014)
Back
Top
✖