ISP hacked OPNSense Router

[peterwkc]

My LAN Windows PC was affected where the pc change background and word document mess up.

[Patrick M. Hausen]

My LAN Windows PC was affected where the pc change background and word document mess up.

So far, so bad. You will need to investigate how that happened. But it does in no way imply that

- your OPNsense was compromised
- your ISP did it

Both things are highly unlikely even in the case of a breached Windows PC.

[peterwkc]

Let me monitor few days and see.

[EricPerl]

Hackers might use your hardware as part of a botnet or for mining, discretely.
Or they might encrypt all your data for ransom. Or just steal it if it's valuable to them.

Announcing their presence with something as visible as a background change and messing with one file doesn't quite fit.

[peterwkc]

I have several cron job to periodic reset wan interface and now it is not working anymore. It doesn't renew my wan ip address anymore.

[passeri]

I have several cron job to periodic reset wan interface

Why?

Perhaps your ISP's system is slow to reconnect a system you have made appear flaky with resets.

[cookiemonster]

I have several cron job to periodic reset wan interface and now it is not working anymore. It doesn't renew my wan ip address anymore.

Recently my OPNSense reboot randomly. Possible of KVM over IP hack? Is it a hardware based remote access.

How to block/disable this?

Why do we keep returning to this thread, it's like a car crash thing. Guess the histerics of title and posts.
Anyways OP, check dmesg for hints. There's a good chance you have hardware problems, as told before. Nothing malign, just simple bad hardware. By the way, what is your hardware including NIC make, model? If reaktek, which driver are you using, the OPN default or another, which?

[borys.ohnsorge]

Check if your reboots are not related to kernel panic's, there have been several threads on this topic recently.

[peterwkc]

Check if your reboots are not related to kernel panic's, there have been several threads on this topic recently.

I do have crash issue in the /var/log/dmesg. I using latest version.

[Patrick M. Hausen]

Then why don't you post the "crash issue" here? None of us owns a crystal ball. The cause for your crashes is in that text!