PROBLEMA Attacchi DOS al router, cosa posso fare?

[rotolo]

Ciao a tutti,
da un paio di giorni ho notato dei forti rallentamenti sull'adsl, una 7mega alice, andando a vedere il log del router netgear dgn2200 ho notato che ci sono stati degli attacchi DOS sabato mattina tra le 5 e le 6 (io non ero connesso):

[DOS Attack] : 2 [IP Spoof] packets detected in last 20 seconds, source ip [192.168.0.20]
Saturday, Oct 24,2015 06:07:36
[DOS Attack] : 2 [IP Spoof] packets detected in last 20 seconds, source ip [192.168.0.20]
Saturday, Oct 24,2015 06:05:46
[DOS Attack] : 2 [IP Spoof] packets detected in last 20 seconds, source ip [192.168.0.20]
Saturday, Oct 24,2015 05:46:16
[DOS Attack] : 2 [IP Spoof] packets detected in last 20 seconds, source ip [192.168.0.20]
Saturday, Oct 24,2015 05:45:16
[DOS Attack] : 1 [IP Spoof] packets detected in last 20 seconds, source ip [192.168.0.20]
Saturday, Oct 24,2015 05:44:16

Stamattina invece un attacco diverso (io ero connesso):

[DOS Attack] : 1 [ACK Scan] packets detected in last 20 seconds, source ip [148.251.49.46]
Sunday, Oct 25,2015 09:43:35

Ho notato che gli attacchi di ieri avevano un ip simile agli ip solitamente collegati, mentre oggi è un ip tedesco.
Il firewall sul router è settato come da immagine


Chiedo a chi esperto di spiegarmi la situazione, se il mio pc è al sicuro e cosa devo fare per evitare altri attacchi, serve cambiare la password di rete (già WPA2-PSK media difficoltà)?

 

[Epr0m]

Ciao,
sicuramente abilitando il firewall sul router hai già fatto qualcosa. Non devi preoccuparti di nulla.
Il firewall del router ha classificato del traffico in entrata come possibile attacco ddos ed ha interrotto subito la comunicazione da quell'ip.
Per sicurezza cambia la password di amministrazione del router con una complessa e disabilita l'opzione di connessione al dispositivo da remoto.
In teoria per essere più sicuro dovresti implementare una soluzione firewall hardware dedicata a monte della linea ( dopo modem router ), che faccia anche da NAT per la rete locale.

 

[rotolo]

ciao ho seguito i tuoi consigli (a parte il NAT per il momento) e ora ho ricevuto questi attacchi, diversi da prima, la situazione sta peggiorando?

[DOS Attack] : 226 [STORM] packets detected in last 20 seconds, source ip [46.198.37.224]
Monday, Oct 26,2015 19:49:04
[DOS Attack] : 167 [STORM] packets detected in last 20 seconds, source ip [46.198.37.224]
Monday, Oct 26,2015 19:48:38
[DOS Attack] : 1 [STORM] packets detected in last 20 seconds, source ip [46.198.37.224]
Monday, Oct 26,2015 19:48:13
[DHCP IP: (192.168.0.6)] to MAC address D0:25:98:8E:BD:FE, Monday, Oct 26,2015 19:20:32
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Monday, Oct 26,2015 17:55:53
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Monday, Oct 26,2015 17:55:29
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Monday, Oct 26,2015 17:55:00
[DHCP IP: (192.168.0.5)] to MAC address AC:B5:7D:57:36:8C, Monday, Oct 26,2015 17:46:40
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Monday, Oct 26,2015 17:38:58
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Monday, Oct 26,2015 17:38:48
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Monday, Oct 26,2015 17:38:29
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Monday, Oct 26,2015 17:38:13
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Monday, Oct 26,2015 17:38:00
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Monday, Oct 26,2015 17:37:28
[DOS Attack] : 1 [FIN Scan] packets detected in last 20 seconds, source ip [91.121.6.28]
Monday, Oct 26,2015 17:34:35
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Monday, Oct 26,2015 17:33:19
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Monday, Oct 26,2015 17:32:51
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Monday, Oct 26,2015 17:32:36
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Monday, Oct 26,2015 17:32:26
[Self2WAN ICMP type b Detected!] To prevent from revealing router's activity, this packet is droppe Monday, Oct 26,2015 17:32:15