Community discussions

MikroTik App
 
ckonsultor
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 53
Joined: Sun Nov 21, 2021 7:57 pm

failed logins "via web"

Wed Sep 07, 2022 9:31 pm

Router log shows lots of attempts to log in that fail, "via web." Would like to confirm that this means the attack is on the port 80 (or 8080?) remote access feature of my hpLite. If so, would a good firewall rule drop packets on TCP 80 that are new when they arrive on the WAN port (Eth1)?
Thanks
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 11439
Joined: Thu Mar 03, 2016 10:23 pm

Re: failed logins "via web"

Wed Sep 07, 2022 10:29 pm

Good firewall (e.g. contemporary default) blocks almost everything targeting router itself coming from internet (i.e. chain=input in-interface-list=WAN action=drop).
 
User avatar
Jotne
Forum Guru
Forum Guru
Posts: 3291
Joined: Sat Dec 24, 2016 11:17 am
Location: Magrathean

Re: failed logins "via web"

Wed Sep 07, 2022 10:59 pm

If you see public IP in the web gui, then you should as mkx hava a look at your firewall.
See this thread: viewtopic.php?t=180838

PS you should not have any open management possibility from internet. Use VPN

Who is online

Users browsing this forum: Ahrefs [Bot], Amazon [Bot], Bing [Bot], emunt6, Florian, stef70 and 74 guests