SOLVED SSH login attempts from my router ip address

[kourosh]

Hi everyone,

Recently I have been getting alerts from truenas regarding SSH login attempts. They are are from my router IP address but different ports. The alerts are:

• SSH login failures:
  • Invalid user from <my router ip address> port 43562
  • Invalid user pi from <my router ip address> port 43560
  • Failed password for invalid user postgres from <my router ip address> port 43914 shh2
  • Connection closed by invalid user postgres <my router ip address> port 43914
  • etc.

Truenas is not exposed to the internet. I am only forwarding port 18080 on a jail for monero daemon.

I don't if it is related or not but this happens when I changed my router to Orbi wifi mesh.

Although, it is not possible to ssh into the system from outside network but it makes me very nervous that I am under some sort of attack.
Any help is appreciated.

Thanks,
Kourosh

 

[Samuel Tai]

This is a "feature" of Orbi. NetGear Armor is a cloud vulnerability scanning service, which is enabled by default. What you're seeing is the Armor scans. You can disable this behavior; see https://kb.netgear.com/000060900/Ho...mor-on-or-off-using-the-Nighthawk-or-Orbi-app.

 

[kourosh]

Great, thank you for your quick response. It all makes sense now.

Kourosh