How can I block certain IP addresses from my router?

Question

I have done some basic things protect my router like disabling wps setting strong passwords and stuff. However, I am using a virgin media superhub 2 where it does not seem to be possible to ssh into it so I can only use the web interface which has very limited settings. e.g. the firewall setting options offered are only low, medium or high and it seems like there is no way to block specific IP addresses. That is very frustrating. Especially as it is also impossible to report the problem using their dedicated online form because it does not accept the IP addresses I input as being valid, when they are.

It seems pretty likely that at best these attacks are slowing my connection and at worst I worry that they might sometimes be successful in compromising my router. Sometimes I have had warnings from google that my IP is making too many requests, which is a worry.

Ideally I would like to block the IP addresses making attacks on my router by sshing into my router but since there seems no way to do this I have been scratching my head, for a while.

It would really help to get some advice on what I might do to protect my router better than I seem to be able to do this without ssh access. One thing I have been considering is putting it into modem mode so I can use a different router and ssh into that but I am worried that this might slow my wifi connection or something. Other than that I am not sure.

Anyway, the most common types of attacks seem to be the following:

• SYN Flood
• ICMP Flood
• TCP- or UDP-based Port Scan (some of these seem to be from my ISP but some do not seem this way)

Answer 1

Consumer routers provided by ISPs commonly use firmware providing very limited device customisability.

While my first thought was to replace the firmware, this thread indicates your service might be affected by doing so, where responses to a similar question on enabling port forwarding on a Virgin Media router/modem included:

You can only use a VM supplied modem on the VM network.

and

Using your own router in modem mode is the only option for port forwarding.

Instead, per the linked thread I'd set the Virgin device to modem mode, and use a cheap, separate device as a router - preferably one that is capable of supporting IP address filtering out of the box. Also, you wouldn't necessarily need to SSH into the device to do so.

It's a shame to need to buy an extra device, but it seems like the limits of your ISP may effectively require it.

Answer 2

I would suggest placing another box in front of your router and running pfSense.

Even Raspberry PI with pfSense can handle normal traffic but it'll choke with fast throughput. If you can afford to spend $169 or so, there are some more powerful hw firewall products with pfSense preinstalled at store.netgate.com.