Hello,
First off, I want to give you a little background on myself so that you know where I'm coming from and what experience level I have in networking and security. I am the engineering manager at a small company, and as such I wear a lot of hats. One of them is to deal with the more advanced networking setup/issues within the company. My formal background is as an Electrical Engineer, with any PC/networking/network security experience coming through dealing with issues in this role, or from my home networking/hobby experience. I have no formal training on network security protocols, attacks, or anything else in the networking space. I'm just trying to pick things up as I go along...
My company has an RV340 router and we have subscribed to gain access to the advanced security features on the router (web/content flitering, antivirus, IPsource guard, threat/IPS, etc). I am having some issues with part of the firewall and some of the more advanced security features. The router is running the most recent firmware version 1.0.03.22, upgraded 10/15/21.
The first problem I'm having is that when I enable the IPS and set the mode to block attacks with the security level set to connectivity, the network suddenly doesn't allow certain applications like Zoom to connect and any internet traffic becomes extremely laggy. I know that this could indicate that there is some sort of breach or other nefarious activity, however there is nothing in the logs from the IPS. Additionally, the problem seems to go away when I leave IPS enabled and change the mode from block attacks to log only. The logs with IPS related events are still empty, however. The log settings are set to log IPS events, and due to the fact that I can't get any information out of the logs, the log level is set to debugging to try and provide as much information as possible.
The second problem I'm having is that I'm running into a situation where it appears like enabling the DoS feature of the firewall periodically actually seems to cause a DoS-like symptoms to happen, in that the internet connection becomes laggy and it becomes almost impossible to access any websites or use any video conferencing apps reliably. An examination of the logs shows that there are a lot of dropped packets (with the "is not associated with an existing connections" tag), as well as a SYN-FLOOD attack detected when the DoS feature is enabled. Disabling the feature still shows a few dropped packets, but the SYN-FLOOD log entries aren't present, and the network and internet connection operates normally. I'm still working on trying to figure out what the IP/MAC addresses which are associated with the SYN flood entries are associated with, but the mere fact that we're not experiencing any type of internet disruption when the DoS feature is disabled leads me to believe that we're not actually experiencing an attack, and that what the firewall is blocking as a result of the supposed SYN flood attack is actually legitimate traffic.
The help section accessed from the router's firmware on the Firewall > Basic Settings page includes a description of the DoS attacks blocked when enabling the feature and the following line: "The traffic rate for SYN Flood, Echo Storm, ICMP Flood are configurable. The default values are: 128,15, and 100 respectively." I have searched through every individual setting on the router and I have not found a location where I can change the configuration settings for the detect traffic rate of the three DoS attacks listed above. Is there actually a way to do this? Does it need to be done through some sort of terminal access instead of through the web based UI?
My theory is that the so-called SYN flood attack that the firewall thinks it sees when the DoS setting is active is something that's just outside the detect range set in the router and that adjusting this would eliminate both the network disruptions and the firewall detections. Does this theory hold any water? Is there anything else that could possibly be causing this type of response to happen? I find it very odd that enabling DoS protection would actually seem to encourage DoS-like results, and that disabling the protection would allow the network to operate normally, assuming the detected attack is legitimate - unless it's some sort of advanced phishing situation.
Anyway, any and all available help is welcomed and appreciated on this - my CEO is really riding me to get these issues ironed out quickly.
Thanks in advance.
