XR1000 Often at password Recovery / Enter Serial #

[BSilverthorn]

Every other day at the moment my XR1000 when attempting to login is sitting at "Your Login / Router has been disabled for 1 minmute" After going thru the process the router seems fine, but when logging back in the next day I am prompted with it again. The Router has been factory reset, setup clean, or had the .cfg restored. Nothing seems to make a differnce. I have tried in my ISP's DMZ on my modem or just behind another firewall. The only change I can think of is I enabled UPNP for a steam game. Any thoughts?

[BSilverthorn]

Think I found it, but not sure how to stop the router from freaking out: These were in the logs:

[DoS attack: ACK Scan] from source 157.240.229.17,port 443 Tuesday, Jun 27,2023 16:26:37
[DoS attack: snmpQueryDrop] from source 52.73.169.169,port 36502 Tuesday, Jun 27,2023 15:40:27
[DoS attack: snmpQueryDrop] from source 205.210.31.199,port 54293 Tuesday, Jun 27,2023 09:56:53
[DoS attack: snmpQueryDrop] from source 192.241.232.28,port 54743 Tuesday, Jun 27,2023 07:40:30
[DoS attack: snmpQueryDrop] from source 8.219.62.181,port 25194 Tuesday, Jun 27,2023 06:05:27
[DoS attack: snmpQueryDrop] from source 146.88.241.51,port 52451 Tuesday, Jun 27,2023 00:46:19
[DoS attack: snmpQueryDrop] from source 204.42.253.130,port 6091 Monday, Jun 26,2023 21:41:19
[DoS attack: ACK Scan] from source 54.164.159.252,port 443 Monday, Jun 26,2023 18:52:06
[DoS attack: ACK Scan] from source 65.8.49.57,port 443 Monday, Jun 26,2023 18:48:55
[DoS attack: ACK Scan] from source 142.251.32.3,port 80 Monday, Jun 26,2023 18:48:38
[DoS attack: ACK Scan] from source 142.251.32.3,port 80 Monday, Jun 26,2023 18:48:25
[DoS attack: ACK Scan] from source 65.8.44.80,port 80 Monday, Jun 26,2023 18:48:25
[DoS attack: ACK Scan] from source 31.13.65.51,port 443 Monday, Jun 26,2023 18:48:16
[DoS attack: ACK Scan] from source 31.13.65.51,port 443 Monday, Jun 26,2023 18:47:45
 

[BSilverthorn]

So Dos attacks just keep coming, I shutdown over night totally hoping they would move on. Any one have some tips on how to tell either firewall to just ignore them?

Getting old not being able to get into the router.

 

[Netduma Fraser]

The XR routers are sensitive in what they report as a DoS attack and actually just show connections you've made. For example, from that snippet I can see you've had a connection with Facebook, Google & Amazon. 

The fact you're getting that when you try to login suggests someone is attempting and failing to login to the router, is it possible someone in your household may be trying to gain access to get around a Traffic Controller rule for example?

[BSilverthorn]

Good question, I will do some snooping and see. Thank you