porkchop12 Posted July 4, 2022 ID:1523355 Share Posted July 4, 2022 I've been constantly getting a RDP detection on port 445, website blocked, inbound but each time its a different IP address. I ran a scan and malwarebytes didn't find anything, what should I do? Link to post Share on other sites More sharing options...
David H. Lipman Posted July 4, 2022 ID:1523358 Share Posted July 4, 2022 TCP and UDP Ports 135 ~ 139 and 445 are used in Microsoft Networking and NT Shares. A Scan by MBAM won't find anything because you are being probed for weak sharing and it is best to just Block all access at the Border/Gateway and the probes won't reach the PC with MBAM. On your Router... Disable acceptance of ICMP PingsChange the Default Router password using a Strong PasswordUse a Strong WiFi password on WPA2 using AES encryption or Enable WPA3 if it is an option.Disable Remote ManagementCreate separate WiFi networks for groups of devices with similar purposes to prevent an entire network of devices from being compromised if a malicious actor is able to gain unauthorized access to one device or network. Example: Keep IoT devices on one network and mobile devices on another.Change the network name (SSID). Do not use your; Name, Postal address or other personal information. Make it unique or whimsical and known to your family/group.Is the Router Firmware up-to-date ? Updating the firmware mitigates exploitable vulnerabilities.Specifically set Firewall rules to BLOCK; TCP and UDP ports 135 ~ 139, 445, 1234, 3389 and 5555Document passwords created and store them in a safe but accessible location. References: Ports DatabaseIANA official ports 2 1 Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 5, 2022 Root Admin ID:1523564 Share Posted July 5, 2022 You can try adding the following Firewall rules to see if it helps, but inbound probes being blocked by your router or another perimeter firewall would be needed to fully stop the probe. You would run the batch file with Admin rights SetCustomFirewallRules.zip Link to post Share on other sites More sharing options...
CristianCP Posted July 18, 2022 ID:1525464 Share Posted July 18, 2022 (edited) Hello! I have also been through similar issues before I've installed a home wifi router. I was being probed once a few days through port 135 and Malwarebytes was blocking it successfully. I have followed most of the recommendations of @David H. Lipman before finding this thread but I am confused with one of the recommendations. If you would be so kind and explain it to me as I am not that experienced. That is : "Specifically set Firewall rules to BLOCK; TCP and UDP ports 135 ~ 139, 445, 1234, 3389 and 5555". How do I do this on a home wifi router such as an Asus RT-AX56U. From what I know, unsolicited router traffic coming from the WAN side / internet, will be automatically blocked by the router, so I don't have to set any rules on my router. Or am I wrong? I have only found an option to block LAN to WAN but this isn't what I was looking for. I can't find any option for a rule or filter list for the WAN side. Maybe it's a more advanced feature not found on home routers. I guess you meant to block these ports if I had a gateway. So the ISP should have these blocked on his side. Thank you and sorry for posting on a few days old thread. I am confused with ports blocking on a router from the WAN side. Edited July 18, 2022 by CristianCP Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 18, 2022 Root Admin ID:1525466 Share Posted July 18, 2022 I don't think that the Asus RT-AX56U allows you to manually enter specific port blocking on the level like a normal firewall does. I may be wrong but searching online I'm not able to find any documentation showing true firewall access. You can set those firewall rules in the Windows firewall, but Malwarebytes is at the same level as the firewall and will see and block them probably at the same time. A true, hardware or external Firewall can be setup if wanted. One of the better known ones is pfsense https://www.pfsense.org/ 1 Link to post Share on other sites More sharing options...
CristianCP Posted July 19, 2022 ID:1525468 Share Posted July 19, 2022 12 minutes ago, AdvancedSetup said: I don't think that the Asus RT-AX56U allows you to manually enter specific port blocking on the level like a normal firewall does. I may be wrong but searching online I'm not able to find any documentation showing true firewall access. You can set those firewall rules in the Windows firewall, but Malwarebytes is at the same level as the firewall and will see and block them probably at the same time. A true, hardware or external Firewall can be setup if wanted. One of the better known ones is pfsense https://www.pfsense.org/ Thank you for your answer, very helpful. Yes, I have them blocked in Windows firewall as well, just in case. As for pfsense, I've heard about it before, it's a good choice and recommendation but I'll stick to my RT-AX56U for now until I learn more on how to create and work with a pfsense router. Link to post Share on other sites More sharing options...
David H. Lipman Posted July 19, 2022 ID:1525502 Share Posted July 19, 2022 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Please review the following to help you better protect your computer and privacy Tips to help protect from infection Thank you 1 Link to post Share on other sites More sharing options...
Recommended Posts