The unstoppable Hacker

[Myleslandish]

I need help stopping a particular level or type of hack that’s taking place and nothing will end it. I’ve saved the logs of the firewall as it’s started to be reconfigured or whatever is happening. It first starts without any of it happening. The isp came a few days ago; said the router was full of alterations. They swapped it with a new one and I connected to it with my firewall and I saved the logs as it was first starting to start bk communicating with a group of ip address groups that are in the private range that have no part in our network. It’s one router we don’t even have a need for an internal network. Just internet access. It starts communicating with variations of 192.0.77.22 192.0.78 and a couple other private ip range networks. Networks our one router isn’t using or supposed to be on. Stuff like that that has NO true home here and it’s an outside path that’s being put in every time it’s ever fixed by them. Starts and follows with continuous probing of the firepower port from the 172.x.x.x a handful of variations. Then these and another small handful of private ip ranges start and continue making connections with the rest. I’ve created access lists to weed them out and in the end if you block them all the internet stops working from that ASA. Remove the restrictions and it works. It’s one home router one home network I’m connecting to on the LAN port to the isp router. Every time they come they have to swap the router and say it’s been heavily reconfigured. 

[Myleslandish]

This is in order but I’m not sure if it starts at the end to the beginning or beginning to end. I mean they go in order of time from the second time to connect after the entire network was reset and given a different router by the ISP. 

[Myleslandish]

I guess because it’s new configuration and has to be re whatevered jacked up and twisted to their will, u can see its constant saying it has a working Ethernet connection but wasn’t working on a few of those because of the various access lists of the fake public ip ranges that are hitting it. Toward the 1 hour mark (which is about the span of time on the connection and is what’s covered in the pictures from this morning. I can’t stand that the ISP even suspects it’s me. It doesn’t make much sense for me to continually alert them to the issues if I’m the perpetrator though. I’m wondering if I can ask them to arrange a constant remote connection for their own confirmations and/or to see what happens as it happens. I know it’s set to where it doesn’t take any full affect until its sure it’s a staying/returning member of the network. It did none of these things in the first hour or so. It was first connected a few hours before and did none of it. I disconnected it, went to town and when I returned I reconnected it, and that’s the hour span of the images I’ve post. If it wasn’t so new of an alteration to the normal network it would show an issue with the connection with the yellow exclamation mark on the Ethernet symbol. It also was so new it’s the first time I’ve gotten this particular answer to why the internet wasn’t working at the moment. It says it can’t connect to the remote network. That shouldn’t be the case. Please please help

[Kasun Bandara]

@Myleslandish hi, we can understand your frustration. i have few request to understand the big picture. 

1. if your firewall connected to internet directly or via ISP router?

2. if its via ISP router, do you have private range between router and Firewall? 

3. is there any NAT rules configured in router?

[Myleslandish]

The outside interface is in the LAN port of the ISP router. The ISP doesn’t bother to do any disabling of all the added functionalities undoubtedly always at play. I don’t get why they haven’t charged her to keep replacing it. It’s been like 1 a year and needed to be more often but bc it’s a difficult subject for all it never comes to that until it’s basically forced to not work. I set up a basic Tenda mesh up in place of the ISP router just before this, and in protest used a few different and constant DoS or DDoS to keep shutting it down basically forcing our hand to go back to the configuration city of the Zyxel from the ISP. It’s bc the Tenda routers were set up to where the only network we used or saved in any way was the guest network. Also disabled PnP and port forwarding. It took a number of days maybe 5 or so idk. With the ISP one that keeps being changed in some way our speeds were always sufficient at between 30-60mb/s max. And by adding over 100ft of Ethernet line to the Tenda mesh instead of the mid level Zyxel gigabit router from the ISP. I thought if anything I was gonna have to explain the loss of some speed for the additional security of starting it all after my ASAs. It was only allowed to work for a week or so then was being bombarded with the attacks. I’m not wanting to log in the router now because of how many times they’ve done this to it and when they showed up last week to put in the new router and diagnose the other one was full of abnormal configurations which is nothing new. But they show up and the line is run out the main isp port and managed from my home little over 100ft away. On the ground had to link two together to get there. Like I said I thought it would be slightly slower. I really mean this when I say I had no idea a basic connection ran that high. It topped the thing out completely at a little over 220mb/s. Never Never has there been speeds like that. I just really think it’s key to see what happens with new connections like now where it was new to my network pretty much. I had to change rhe BVI to 162.x.x.x to avoid having to even need to change its ip. I’m sure I have more than u ask for. It’s just spectacular to heave a listener Fr. Thanku.

[Myleslandish]

Sorry. It’s hard to stay on point with this. Too much information and too much emotion. I just reread that and it makes me want to redo it but I’ll just ask for some understanding instead.