Daily Port Scans -- Multiple Routers

[networkmage]

I have a sonicwall set up behing a prosafe Netgear router. The prosafe has a good firewall and security settings.

What I do not understand is why the Sonicwall firewall logs show multiple port scans and intrusion attempts from outside IP's daily, that target all of my vlans/subnets? How are they scanning my interior private network and ports when the Prosafe router should be stopping all of that at WAN.

 

[scout_03]

post link of the prosafe since all i see it is a switch and not a routeur .

 

[networkmage]

netgear prosafe srx5308

https://www.netgear.com/support/product/SRX5308

 

[scout_03]

this mostly use as a firewall and not a simple router system ( VPN Firewall ) we you look at link you see this this and not a router with switch so you will have to check the set up in so you wont have to use also soniwall to filter the same thing . stay around someone else might have use this .

 

[bill001g]

The scan more than likely is coming from a internal machine.

I can't even think of a way to intentionally allow it to happen. By default all inbound traffic will be dropped because the NAT does not know who to send the traffic to. If you were to put in a DMZ then a single machine could be port scanned because all the ports map to that machine.

Since there is only 1 port 80 as a example a outside attacker can really only scan that port 1 time, it would not be possible to scan a bunch of different internal machine on port 80 because there is only a single IP address on the WAN side.

 

[networkmage]

That makes sense...because I see lots of my internal IP's dropping each-other all over the place.

But When most of the port scans occur, in the logs, on all routers, including the Sonicwall, the source IP's show up as outside IP's not internal, that's what I do not understand..and this is happening behind the Netgear Prosafe router(main router) on the Sonicwall logs and separate wireless subnet router logs..all showing outside IP's (china..russia..etc) scanning or dos attempt.

 

[scout_03]

did you google the ip addres might lead to some of your software that check on net .