I have been using Jio router since 2023. It's a Jio Centrum with firmware SRCMTF1_JCO4032_R2.52.1 version.
Last month I setup a home server running Debian inside my network to work on it via ssh. It doesn't have any internet facing services running. Neither I have opened any ports on the router. Only use the server gets is SSH from my Windows laptop to run my projects.
Yesterday I checked the logs for an unrelated program but founda lot of SSH login attempts. Surprisingly the ip address is my router. All attempts are from 192.168.29.1 and router's link local IP.
A sample:
To test I started a VM on the server with its own ip and it also started ssh attempts from the same router IP in about an hour. The usernames attempted are the same pool of 25 and repeating.
I checked that I cannot reach my server from outside the network. I have no clue what is happening here. Does anyone have any idea?
Last month I setup a home server running Debian inside my network to work on it via ssh. It doesn't have any internet facing services running. Neither I have opened any ports on the router. Only use the server gets is SSH from my Windows laptop to run my projects.
Yesterday I checked the logs for an unrelated program but founda lot of SSH login attempts. Surprisingly the ip address is my router. All attempts are from 192.168.29.1 and router's link local IP.
A sample:
Code:
Sep 20 00:56:36 homeserver0 sshd[46805]: Invalid user admin from fe80::96cb:a8ff:180a:1abc%vmbr0 port 35263
Sep 20 00:56:38 homeserver0 sshd[46805]: Failed password for invalid user admin from fe80::96cb:a8ff:180a:1abc%vmbr0 port 35263 ssh2
Sep 20 00:56:38 homeserver0 sshd[46805]: Disconnected from invalid user admin fe80::96cb:a8ff:180a:1abc%vmbr0 port 35263 [preauth]
Sep 20 00:57:22 homeserver0 sshd[46933]: Invalid user admin from 192.168.29.1 port 59606
Sep 20 00:57:24 homeserver0 sshd[46933]: Failed password for invalid user admin from 192.168.29.1 port 59606 ssh2
Sep 20 00:57:24 homeserver0 sshd[46933]: Disconnected from invalid user admin 192.168.29.1 port 59606 [preauth]
Sep 20 00:57:45 homeserver0 sshd[46998]: Invalid user user from fe80::96cb:a8ff:180a:1abc%vmbr0 port 36355
Sep 20 00:57:46 homeserver0 sshd[46998]: Failed password for invalid user user from fe80::96cb:a8ff:180a:1abc%vmbr0 port 36355 ssh2
Sep 20 00:57:47 homeserver0 sshd[46998]: Disconnected from invalid user user fe80::96cb:a8ff:180a:1abc%vmbr0 port 36355 [preauth]To test I started a VM on the server with its own ip and it also started ssh attempts from the same router IP in about an hour. The usernames attempted are the same pool of 25 and repeating.
I checked that I cannot reach my server from outside the network. I have no clue what is happening here. Does anyone have any idea?