2

When checking my router tonight I looked at its security log. I saw thousands of blocked tcp traffic. Why are these considered security events? The log shows many blocked tcp incoming request from many different ips and on different ports. Here is one example below: TCP Blocked Connection On Security Log

Does a log fill up with thousands of blocked tcp events like this through normal internet surfing or is this something to be more concerned about? Or does this just mean the router's firewall is just doing its job and logs every time it receives tcp traffic inbound that I did not initiate?

(As a side note I did find UPnP was on and Wifi Protected Setup was on too by default, so I turned those off)

1

You don't have to worry about this logs. Anything connected to the internet will receive lots and lots of connection attempts every day, from random scans, bots, and security researchers.

Just configure the router to deny WAN access and you will be protected from the vast majority of the attacks. And your router will generally rotate the logs when they grow past a defined threshold, so its storage will not fill up with logs.

0

Looks like you need to reconsider the configuration of the router, policies, rules, logs and so on. If you have many entries of that type on your log it is because of a reason, port scanning, IP rule, or a misconfiguration of the router. On the other hand, you need to consider that on outbound interfaces (interfaces that are plugged to the Internet) are full of bad/anomalous traffic that it would be good idea to pre-filter on your eth0 device.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.