[pfiltz]

Thanks to the folks who suggested for me to look into getting my Netgear Routers to setup our IPSec VPN. Works great. Thanks.

I do have one question though.

I have setup some rules to help beef up security on them, to try and prevent hackers, such as.... These area of IT is a bit over my head to start with. I'll admit. I'm just a part-time IT person for a small company.

I have these rules in place

To Block Always

AIM
TELNET
DNS
FINGER
SQL-NET
NEWS
TFTP


WIth that being said, I see things like this in my log..

Tue, 2009-11-17 05:09:52 - ICMP packet - Source: 113.147.134.170 -
Destination: 65.81.104.5 - [ICMP Type: 8 Code: 0 Access Policy not
found, dropping packet from WAN]

Or

Tue, 2009-11-17 05:09:34 - UDP packet - Source: 91.62.97.138 -
Destination: 65.81.104.5 - [Access Policy not found, dropping packet Src
1044 Dst 6211 from WAN]

When I go out to whatsmyipaddress and check, those Source numbers are sometimes in China, UK, or where ever.

WHY?

I have a pretty lengthy password on the routers, and both are different. Anything else I should do to maximize security on them?

TIA

[cwwozniak]

The access attempts were most likely hackers on the Interent scanning random blocks of public IP addresses looking for vulnerable systems. The router was just logging the fact that it blocked the incoming connection attempts. You can easily get several hundred blocked attempts per day.

There is another possibility if your Internet service uses dynamic public IP addresses. The previous user of the address that you now have may have been running a game server or a file sharing program and other computers are still trying to connect to their computer.

[midders]

For greatest possible security you should block all incoming and outgoing traffic by default and have specific allow rules for traffic that is permitted. Remote administration of your router should be disabled, so that only LAN users with the password can possibly change the router settings. Also disable UPnP unless it is specifically required by your company.

[pfiltz]

Appreciate the info guys...

My main concern of course, is security.

I'll disable UPnP as well.