So, the other day my Internet was down and a public IP address was not available from my ISP. The next day the Internet was still down; however, I noticed that I received a private IP address from my ISP that raised a red flag. My configured router's address is 10.0.8.1, yet my ISP was attempting to connecting to 192.168.88.1 the router's default IP address. So is this default address available even when the router has a custom configuration? Below is what my IDS/IPS showed and I wondered whether my ISP was on a phishing expedition with a 10.8.8.1 address as well as whether my router gave out its name Mikrotik why they tried the default address:

Hey. It's DNS flood from outside, perhaps from your ISP. So just disable your DNS "allow-remote-requests" option. If it's already disabled, then relax. Every router in the world drops so many trash you can't imagine.

Hey. It's DNS flood from outside, perhaps from your ISP. So just disable your DNS "allow-remote-requests" option. If it's already disabled, then relax. Every router in the world drops so many trash you can't imagine.

Yes, I know it's harmless traffic; however, I have an edge pfSense box that strictly forbid external request. I did notice that "allow-remote-requests" was enabled, and I disabled it.

What I am pissed about is it appears my ISP wanted to hit me up with service charge. I paid for a public IP address, yet the Internet was down then, came back with a private IP address to make the router appear to be working with link light blinking. After the intrusion that disguised as a DNS request flood event, I received a call/voice message from the ISP saying staffs were coming out to check for trouble.