The new router is showing a continuous flow of brute force attempts against your device.
The new router is showing a continuous flow of brute force attempts against your device.
Hello, I recently switched to a Netgear Nighthawk AX4300 router. I’ve set up a few ports forwarded to my home server for RDP and Emby (similar to Plex). The device includes a 30-day trial of Armor software. Since I forwarded the ports about a week ago—after installing the router—I’m receiving around 100 alerts each day claiming that “Netgear Armor has blocked a brute force hacking attempt on [my computer] from [various IP addresses].” The activity appears to be growing over time. An IP address often repeats briefly before changing, suggesting either multiple attackers or one using a VPN and rotating IPs. Is this genuine? Could there really be more hackers trying to crack my login, which is already pretty mundane? Or are the alerts just false positives from Armor? I had these ports forwarded on my previous router for years without issues, but these notifications are a bit alarming. Thanks!
Did you enable port 3389 on your router? Is it one of the frequently targeted ports for breaches? Consider disabling it and check if the problem resolves.
Running RDP publicly invites dictionary attacks. Avoid exposing ports 445 and 3389. You might limit or slow traffic with ufw, but these scans will persist. The safest approach is to use a VPN for remote access.
These are automated assaults. The majority originate from bots scanning the web for vulnerable open ports and instantly attempt to exploit them. Those controlling the bots probably remain unaware until they successfully breach and compromise your data. Attackers typically don’t know if your system is valuable until they’ve tested it. Be cautious with personal files—they can lead to identity theft, blackmail, or ransomware. If you need remote access, configure a VPN through your router and connect to your internal network. Avoid sending sensitive information such as RDP directly over the internet.
RDP on port 3389 is frequently targeted by automated attacks. Other common ports include SSH (22), FTP (21), and SMB (445). ^^^DO NOT SHARE THESE ADDRESSES!!!!^ If you need to connect internally from outside, consider configuring OpenVPN over port 443 for secure communication.
I understand it's taken some time, so I'll wrap up here. I turned off the port forwarding for RDP, and the alerts about brute force attempts vanished right away. I've been using RDP port forwarding for years, and when I first began, I didn't notice any warnings against it. It highlights how security practices evolve. Thanks for your assistance!