0

This is a very basic question, I realize, yet I can't find the answer anywhere.

The situation is simple: I have a router from my ISP, behind which I'm running a few (home)servers. Port forwarding is set up on the router on only a few ports, to select computers. For instance, I need to connect via RDP using port 443 at work, so that's forwarded to one computer specifically.

Yet a different server entirely (on a different local IP) has an amazing amount of blocked traffic incoming on that port. Furthermore, there's a whole slew of other ports that this server is often blocking.

How come this traffic is even reaching that server's firewall? Shouldn't the router be doing that job?

3
  • You should review the firewall setting on your router. When you have a DNAT setup on your firewall, depending on operating system on the router in question three actions are performed independently of each other. Filter the incoming traffic and forward the traffic to internal interface and filter traffic on internal
    – fossil
    Jun 2, 2019 at 17:04
  • This is just a guess, but someone might be using UPnP to configure unauthorized port forwards. I'd try turning UPnP off in the router (and rebooting it), and see if that stops the attacks. Also, is the router's firmware up to date? Jun 2, 2019 at 18:02
  • Thanks for the input, both, and apologies for the slow response. The router doesn't have updates to its firmware, so I'm guessing that's where the issue lies, along with the UPnP trouble outlined by that link (thanks!) Jun 18, 2019 at 13:51

0

You must log in to answer this question.

Browse other questions tagged .