I've found some ip address that's not in my DHCP range.. which is weird because I set my DHCP range 192.168.2.xxx but these ip have 172.xxx.x.xxx or 192.168.1.xxx range I want to block them, how? I'm using D-Link DIR-605L N 300 router.. Thanks.
|show 5 more comments|
First, note the "Helpful Hints" section of the page (top right). the NAPT page shows WAN->LAN connections, so most of the hosts on the list will be outside your network (and obiviously would not be assigned by your DHCP.). Also note, that each has a UDP Session count of 1. UDP is a connection-less protocol, so usually NAT treats each packet as a session, unless the packets are received in a timely manner on a port a packet was just sent out on.
The 192.168.x.y and 172.16.x.y addresses are likely your ISP network, since those are RFC1918 blocks and are not publicly routable. Many cable modems use the network 192.168.1.x. do a tracert to those hosts and see if they are on your providor network. they may be your ISPs DHCP and DNS servers since they are UDP streams.
since these connections are involving comms partners that are outside your network, you can block them at the firewall, by establishing a kill rule. check your router documentation for instructions as to how to set up the firewall, and kill those connections, even if they are solicited from inside your network. also make sure you don't have any ports forwarded in NAT.
You are looking at the wrong table, if you are trying to see if some guy is connected to let say the wireless facility of your router the NAPT table is not the one.
The NAPT table shows you the connections that you are establishing to the outside world seen by your router's NAT (Network Address Translation) engine.
If you want to see if you got "company" try to see the DHCP table and see there if there are assignments to unknown users.