Lets block them!

[Ubuntux]

These IPs has tried to gain access to my nas (Yes, my nas is avaible public, but only if you know the passwords! )
I will keep this thread updated with replys. Please share the IPs you caught!

5.79.71.195
24.172.92.178
37.48.74.75
46.158.149.26
61.223.24.72
62.210.99.31
62.210.136.203
62.210.192.84
66.240.192.138
66.240.236.119
71.6.135.131
71.6.165.200
71.6.167.142
77.68.37.155
77.236.97.96
78.186.124.15
79.148.245.79
80.82.64.29
82.221.105.7
83.170.113.200
95.37.13.118
95.37.48.176
95.37.127.64
121.52.145.115
128.199.197.82
151.250.128.150
152.44.159.242
176.45.80.78
178.86.13.234
188.53.103.226
192.99.147.201
193.104.41.56
194.58.88.39
195.88.209.183
195.189.80.21
195.206.253.146
198.20.69.98
198.20.70.114
200.232.163.37
211.1.224.76
212.83.149.193
213.221.131.200
219.141.157.33
220.226.188.152

This thread is not to discuss the usage of black/white list. I tried the black list and i got tired of blocking all other countries but my own and yet still being blocked..

[Ubuntux]

UPDATE!

98.113.167.226
201.220.71.6
41.41.160.67
114.36.62.58

[damien599901]

what's the goal of this topic?

[Kapitein Haak]

To create a very long list of IPs which cannot be entered manually as the ADM interface probably won't support it. I've had some IPs blocked when I forwarded the ssh port (22) to the NAS temporarily. I used a high port number for SSH access before and never had any blocked IPs, so I moved it back to a high port again (between 1024 and 65535). No more blocked IPs at all, though I only have a few ports forwarded to my NAS below 1024. I also stopped using the default ports for ADM (8000 and 8001). Besides that I now have geoblocking active, which should help as well.

Best regards,
Kapitein Haak.

[damien599901]

Ok. I understand now
Thank you very much for your explanation

[Ubuntux]

The point of this thread is a beginning of blocking IPs that try to access nas servers.

I have requested Asustor to add a feature named "Smart IP blocking". This would be an app that would be connected to a main server and all other Asustor servers would as well. If we then say an IP tries to access 10 or 100 nas servers they will alert the rest and the IP will be blocked so it will be blocked on the rest. I dont change port.. Why run from something you can block?
I tried the geo blocking, but even tho i whitelist my whole country i still get issues with IPs in my own country.. and thats not really that much interesting... also by blocking them we would send a signal.. maby this would be smarter from the router, but they dont offer this kinda blocking tool..

[sosad]

so I moved it back to a high port again (between 1024 and 65535). No more blocked IPs at all, though I only have a few ports forwarded to my NAS below 1024. I also stopped using the default ports for ADM (8000 and 8001). Besides that I now have geoblocking active, which should help as well.

[PinguMann]

This is a very laborious way to do a fundamental Admin job.

Check my reply in the post: "Security Concerns - Log File" -- http://forum.asustor.com/viewtopic.php? ... 591#p24742

It eliminates lists and such Admin intensive "work-arounds".
It requires Command Line Interface CLI access with Terminal/PuTTY to the NAS though - which can be learned ...


PinguMann