"Quote from: drosophila on December 15, 2025, 11:37:49 PMYes, that's perfectly normal. And also yes, the consumer routers don't even bother to create such logs, as they're not useful to their intended audience (since the average user couldn't do anything about it, anyway) and in fact more likely to cause the effect you experienced. ;)
Yes, the truth is that I was surprised by the number of scans. But I am not surprised so much that these scans exist, but rather in the sense that, if they exist, and considering that no system is perfect, additional measures must be put in place immediately afterwards. They have suggested incorporating Fail2Ban but I was looking for a plugin that could scan the packets that can bypass the blocking rule.
It is true that the home user did not understand the information provided by the logs, most do not even know how to enter the configuration, but it would not be superfluous to incorporate a simple log into each router for any technician who may need it to audit or correct any anomaly.
Quote from: drosophila on December 15, 2025, 11:37:49 PMSkimming these screenshots, there seems to be only a single instance of an actual "port scan" in the traditional sense, which is the one coming from 185.246.128.192. All others either are "trickle scans" (which is unlikely, you only use these when you have a specific mark and know they're looking out for scans) or just misdirected connection attempts by legitimate users. These come from outdated dynamic address info, which you get literally on a daily basis with IPv4 (the entire point of using DynDNS services). Most are single connects, which could be looking for one specific service to (ab)use (probably some IoT stuff, which has a high probability of being both outdated and unprotected. Maybe a botnet trying to find peers.). But then again, the ports wouldn't differ so much (IMO). If you're curious, you could try looking up these ports to see what they might be after. Or it might just be what happens when something like bittorrent is started with a cache more than a few weeks old. And then look at the guy on 45.142.193.191, several attempts to the same port (52073). Probably someone trying to connect to their buddies self-hosted game server. Or someone about to find out that their own DynDNS had failed, as happened to me more than once. :) You'd probably see a few pings afterwards the first time they experience that. ;)
In this regard, given that it is a domestic connection with dynamic IP, surely many attempts can be inherited from whoever previously had this IP assigned. While it is true that there are probably remnants of previous scans, this does not mean that IPs from Shodan "care" more, since they may have a clear intention to expose credentials. Hence, take precautions as much as possible.
Quote from: drosophila on December 15, 2025, 11:37:49 PMSo, as has been said: make certain to only have ports open that you know about, and then make certain these services are protected as good as you can manage, and also run only when they actually need to run. The really dangerous stuff would appear in green, indicating something was allowed through. So you'd filter for unexpected connection attempts to the services you do have open and check the logs of these services. You could also try to find any suspicious activity from their pattern (if there is any), and then ponder what could possibly be done to prevent that.
For a while I was wondering about the lucky chance of someone probing a port that has been opened for replies to an outgoing request, but that's why firewalls track those (this is the "state violation" part of the message). Note that if you open some port for games or such you'll not be in immediate danger when the game isn't running: the packet will be allowed into the LAN, reach your PC and then go poof. However, your system will send an ICMP error message, so the attacker knows that a system is reachable on that port, but has nothing there. So it could be used to map you out and plan an attack based on that info, but attackers are lazy and will just move on to find easier prey. Especially with your IP address changing daily, they'd lose track of you unless they are tracking your IP. In that case, you should indeed be worried, but of course you'll never know about that until it's too late (or not even then).
In my case the exposed ports are from P2P applications. They are not from games or anything else. Which means that I can even disable them and enable them again when I need them since I have control of the Firewall myself. This would allow me to analyze the erroneous attempts more slowly and filter the open ports when I have more time to analyze.
Quote from: drosophila on December 15, 2025, 11:37:49 PMSo, the net sure has become busier than a decade ago, but that's a given with the number of devices and people connected. More noise, and more potential victims.
Of course, I have IoT devices that I need to review. Home Assistant is implemented so that in the long run everything will be under local control, but there are some devices that still connect to the manufacturer's cloud and therefore expose part of the system. Hence the intention (not yet implemented) to isolate IoT devices in a separate VLAN as I have done with the Management VLAN for managing Proxmox Hosts and other devices at the administrative level. For me, it is the best way to segment and isolate.
Quote from: drosophila on December 15, 2025, 11:37:49 PMRansomware usually arrives through email. Basically, anything with an attachment definitely is, and anything without has links to either phishing or more malware. This has always been the most successful attack, and its likelihood of working against you increases with every account you create: more places to steal information from, more information to be stolen, more context to create a believable scam. Currently, there seems to be quite the success with "Payment declined: your cloud data is in immediate risk of being deleted". Of course this works better than the "African prince inheritance fund" scam, because so many people made the mistake of using cloud storage services. Yes, I think it's a liability for businesses, too.
The cases of Ransomware experienced by third-party companies during my working life activate caution with unknown sources. All accounts that can be compromised with MFA and random passwords of at least 20 self-generated characters, local password manager with access via VPN or local, never from the WAN. And obviously the certainty that princely inheritances do not touch and that if it is necessary to update bank data, for example, the entity must request a visit to an office in person. I think what happens with most people is that they see computing as the use of another household appliance and that they are not aware of the danger of identity theft or data theft with which to blackmail. Although, due to many preventive measures, we are all human and can fall for scams, I think that in this aspect I am sufficiently aware. My concern is more about implementing effective additional protections than believing that in an interconnected world an operator router is sufficient to protect an infrastructure.
Quote from: drosophila on December 15, 2025, 11:37:49 PMBTW: please correct me if any of my conclusions or reasonings are flawed!
