ISP hacked OPNSense Router

[thecrankygamer]

Most probably my ISP has hacked my router. (Dont' argue this). 

LOL, no, just no, your isp didnt hack nothing.
And then to say we cant argue that, are you kidding me? If nothing is opened to wan side, not even your ISP can hack the opnsense box.

[peterwkc]

Most probably my ISP has hacked my router. (Dont' argue this). 

LOL, no, just no, your isp didnt hack nothing.
And then to say we cant argue that, are you kidding me? If nothing is opened to wan side, not even your ISP can hack the opnsense box.

I think you didn't see my screenshot that i shared. It's full of block packet in the firewall log.

[Patrick M. Hausen]

So? Your firewall is connected to the Internet. So bad actors will scan it 24x7. And the OPNsense firewall will by default block all of these attempts. The log showing all of these blocked packets is proof that the firewall is working. Not the other way round.

[peterwkc]

So? Your firewall is connected to the Internet. So bad actors will scan it 24x7. And the OPNsense firewall will by default block all of these attempts. The log showing all of these blocked packets is proof that the firewall is working. Not the other way round.

Yes, My firewall connected to Internet. Today, the firewall reboot twice times by itself. I don't know whether my firewall was hacked. Moreover, on the day before yesterday, My PC cannot ping the default gateway ip address. So, I suspected LAN PC was hacked. My others PC which did not connect to Internet able to ping. So, this is strange to me.

[Seimus]

Sporadic reboots are caused mostly due to crashes, not hacks. Your PC not pinging the GW or not having network access are examples of issues on your network or the GW usually. Or the host itself had an issue if it was isolated to just one device. This doesn't exclude that you can have an infected device via a Virus, but that's not hacking that's a virus.

Once again, if you didn't open ports towards internet, didn't allowed SSH & HTTP/s GUI management, there is no way you could be hacked from internet.

Your mindset is totally wrong on this.

Regards,
S.

[DEC670airp414user]

So? Your firewall is connected to the Internet. So bad actors will scan it 24x7. And the OPNsense firewall will by default block all of these attempts. The log showing all of these blocked packets is proof that the firewall is working. Not the other way round.

Yes, My firewall connected to Internet. Today, the firewall reboot twice times by itself. I don't know whether my firewall was hacked. Moreover, on the day before yesterday, My PC cannot ping the default gateway ip address. So, I suspected LAN PC was hacked. My others PC which did not connect to Internet able to ping. So, this is strange to me.

if i was haxor id want your pc and router to stay ONLINE.   not reboot, as id lose access to trying to steal all of your porn collection
this entire thread is nonsense

[peterwkc]

So? Your firewall is connected to the Internet. So bad actors will scan it 24x7. And the OPNsense firewall will by default block all of these attempts. The log showing all of these blocked packets is proof that the firewall is working. Not the other way round.

Yes, My firewall connected to Internet. Today, the firewall reboot twice times by itself. I don't know whether my firewall was hacked. Moreover, on the day before yesterday, My PC cannot ping the default gateway ip address. So, I suspected LAN PC was hacked. My others PC which did not connect to Internet able to ping. So, this is strange to me.

if i was haxor id want your pc and router to stay ONLINE.   not reboot, as id lose access to trying to steal all of your porn collection
this entire thread is nonsense

I can share video about my block packet to you to proof that the hacker had tried to connect to WAN.  I got enemy that why my ISP want to spoil me. By the way, thanks for your effort to reply this thread.

[Patrick M. Hausen]

Blocked packets are proof that your firewall is working. Every system connected to the Internet is scanned by automatic bots 24x7. There's nothing one can do about that but use a firewall that blocks these attempts as OPNsense does by default.

Blocked == not hacked == good.

[passeri]

@peterwkc, please advise straight answers to the following:

• Are your firewall rules all in the default state?
• If not, please provide any and all NAT or port forwarding (or other) rules you have created, edited, or removed.

As noted early in this thread, we can not exclude an infection on your internal machines, arriving through phishing or downloading dodgy software. We can tell you what, if any, exposures you may have on your firewall.

As noted more than once by Patrick, the logs you have provided show normal and effective operation of the firewall. You have also not yet described any "hacker" behaviour which would be logical for a real external intruder. If your ISP did not like you, they could more simply randomly drop your connection. It is again hugely improbable.

We may be able to help with clear answers about configuration. Remember, your fears about TinyPilot proved unfounded once you had looked into and understood it better.

[Seimus]

I can share video about my block packet to you to proof that the hacker had tried to connect to WAN.  I got enemy that why my ISP want to spoil me. By the way, thanks for your effort to reply this thread.

NO, just NO, this is normal.
Everybody sees this or had in a point of time seen it. Doesn't matter what FW/Router you use, Open source, Off the shelf or Enterprise. If you use a device on the edge > Internet, this is what is in today's manners expected to be seen.

Blocked packets are proof that your firewall is working. Every system connected to the Internet is scanned by automatic bots 24x7. There's nothing one can do about that but use a firewall that blocks these attempts as OPNsense does by default.

Blocked == not hacked == good.

Exactly, couldn't say it myself better.

OP, the only proof you state or post, is so far proofing that all is well working and blocked Ingress towards your WAN.

Regards,
S.

[EricPerl]

Some of the blocked sources were on crowdsec's radar. It means that these sources are known as being owned by bad actors on a global scale...
You're not the only target. EVERYBODY is. If you have a public IPv4, you will see unsolicited requests.
It's the sad reality of today's internet. That's why you have a firewall at the edge of your network.

There have been plenty of reports of compromised consumer routers (e.g. TP-link) but you're using a commercial grade router...
With OPN set to reject all incoming traffic on WAN, I'd be more worried about malware or compromised poorly maintained devices.

[peterwkc]

@peterwkc, please advise straight answers to the following:

• Are your firewall rules all in the default state?
• If not, please provide any and all NAT or port forwarding (or other) rules you have created, edited, or removed.

As noted early in this thread, we can not exclude an infection on your internal machines, arriving through phishing or downloading dodgy software. We can tell you what, if any, exposures you may have on your firewall.

As noted more than once by Patrick, the logs you have provided show normal and effective operation of the firewall. You have also not yet described any "hacker" behaviour which would be logical for a real external intruder. If your ISP did not like you, they could more simply randomly drop your connection. It is again hugely improbable.

We may be able to help with clear answers about configuration. Remember, your fears about TinyPilot proved unfounded once you had looked into and understood it better.

I have added one rule block in wan and have several firewall aliases like crowdsec. Opt1 block to lan. No sshd no open port. Opt1 WiFi provide based on mac address.

I worried they use malware to get access to my system.

My firewall reboot this morning again. I don't know whether this is crash or have backdoor script

[cookiemonster]

> My firewall reboot this morning again. I don't know whether this is crash or have backdoor script
I'll repeat again. WAN will block everything not solicited from the inside by default. You can of course add blocking aliases but they are mostly unnecessary if they initiate from the outside. If the connection is a response to a request from say a compromised lan device ie. you download some dodgy application infected with malware, then the firewall alias block will be of little use.

Another reboot? Most likely a hardware problem. Look in the logs of the system. The message buffer is wiped on reboot but the previous log will be saved to /var/log/ . Look for the dmesg files.

[JL]

Dear all, I had installed opnsense quite long time ago but recently my LAN cannot browse internet. Most probably my ISP has hacked my router. (Dont' argue this). 

Im looking method to harden my OPNSense router. Please suggest. Thanks.

Harden OPNSense Methods:
1. Disable SSH services
2. Disable root user in web gui option
3. WiFI based on MAC Address only
4. Installed Suricata IPS
5. Disable boot into single user mode to prevent hacker change password
6. How to enable sudo?

Hire a professional, you are not making much sense and show a lack of objectivity without providing sensible evidence.

[philippe_crowdsec]

I have also been running (and still do) Crowdsec which I like a lot. If only they had a hobbyist license tier for e.g. 100€ per year. Now it's free edition with quite some limitations or something around 90€ per month - prohibitive, unfortunately.

Thanks for the kind words.

Just to be clear, the IDS, IPS, WAF, and all rulesets and scenarios have absolutely no limitations.
The only limited features are in the SaaS and the ones for corporations (auto-enrolment, alert context, AI-driven list, etc.) and the ones that are costly for us (like storing 1Y of incident history).

You even get a large and frequently updated blocklist in the free tier.
Premium, AI and Platinum blocklists are our paid products indeed.