D-Link Forums

D-Link Wireless Routers for Home and Small Business => DIR-605L => Topic started by: Commissar on February 15, 2019, 09:31:02 AM

Title: Router Troubleshooting, flood attack on lan ports..
Post by: Commissar on February 15, 2019, 09:31:02 AM
Hi there, im new on this forum, i have problem with router like i have 20mb internet speed with cable directly puted into PC, but when i put into router then from router into PC, my internet speed is 2-3 mb.. i have firewall on pc and i blocked every single application and still its 2-3 mb speed..
I found something interesting on router configuration,

Time and Date   Message
Feb 15 18:28:12   Per-source ACK Flood Attack Detect (ip=104.16.59.37) Packet Dropped
Feb 15 18:28:12   Whole System ACK Flood Attack from WAN Rule:Default deny
Feb 15 18:27:12   Per-source ACK Flood Attack Detect (ip=104.16.59.37) Packet Dropped
Feb 15 18:27:12   Whole System ACK Flood Attack from WAN Rule:Default deny
Feb 15 18:26:12   Per-source ACK Flood Attack Detect (ip=104.16.59.37) Packet Dropped
Feb 15 18:26:12   Whole System ACK Flood Attack from WAN Rule:Default deny
Feb 15 18:25:12   Per-source ACK Flood Attack Detect (ip=104.16.59.37) Packet Dropped
Feb 15 18:25:12   Whole System ACK Flood Attack from WAN Rule:Default deny
Feb 15 18:24:12   Per-source ACK Flood Attack Detect (ip=104.16.59.37) Packet Dropped
Feb 15 18:24:12   Whole System ACK Flood Attack from WAN Rule:Default deny

thats these packet drops, i tried to fix it and trying to find a solution but nothing works i tried everything, from to turn (router) firewall off (didnt helped), to turn everything off(also didnt helped), im currently using DIR-605L router soo i really need help, because i dont want to spend money on a new router..   :)
Title: Re: Router Troubleshooting, flood attack on lan ports..
Post by: FurryNutz on February 15, 2019, 09:32:34 AM
Link>Welcome! (http://forums.dlink.com/index.php?topic=49573.0)

What model D-Link router do you have?



Internet Service Provider and Modem Configurations

Check the IP address you see in the attack at domaintools.com to see where that IP address is coming from.
Title: Re: Router Troubleshooting, flood attack on lan ports..
Post by: Commissar on February 15, 2019, 09:37:08 AM
Link>Welcome! (http://forums.dlink.com/index.php?topic=49573.0)

What model D-Link router do you have?

  • What Hardware version is your router? Look at sticker under the router case.
  • Link>What Firmware (http://forums.dlink.com/index.php?topic=47512.0) version is currently loaded? Found on the routers web page under status.
  • What region are you located?
  • Are you wired or wireless connected to the router?


Internet Service Provider and Modem Configurations
  • What ISP Service do you have? Cable or DSL?
  • What ISP Modem Mfr. and model # do you have?

Check the IP address you see in the attack at domaintools.com to see where that IP address is coming from.


i have dlink DIR-605L
Hardware: B2
Firmware 2.12
Region: Serbia
Im wired connected

ISP Service: KBCNet
And Cable
Title: Re: Router Troubleshooting, flood attack on lan ports..
Post by: FurryNutz on February 15, 2019, 12:06:19 PM
If you have the SPI firewall enabled then this is the router doing it's job and reporting whats happening in the logs. It's stopping the attacks.
You'll need to contact your ISP to see if they can help you block these from actually happening or move your modems IP address your ISP gives you to a different IP address. However the attacker could follow you.

Good Luck.
Title: Re: Router Troubleshooting, flood attack on lan ports..
Post by: Commissar on February 15, 2019, 12:12:59 PM
I already did, but they said its not attacker, its a something about firewall rules are so strict, so router is distraffic the ports..
so i dont know how to change the rules at firewall
Title: Re: Router Troubleshooting, flood attack on lan ports..
Post by: FurryNutz on February 15, 2019, 12:21:46 PM
The firewall feature is mostly automatic. You can set Port Forwarding configurations to help with ports getting thru from the WAN side. Theres no configurations for the firewall though. It's automatic. What happens if you temporarily disable SPI? Re-enable after testing.

What was the details of that IP address listed in the logs?
Title: Re: Router Troubleshooting, flood attack on lan ports..
Post by: Commissar on February 15, 2019, 01:09:40 PM
The firewall feature is mostly automatic. You can set Port Forwarding configurations to help with ports getting thru from the WAN side. Theres no configurations for the firewall though. It's automatic. What happens if you temporarily disable SPI? Re-enable after testing.

What was the details of that IP address listed in the logs?

When i disable spi, logs are not showing anymore, but the ping is higher than usuall..
Title: Re: Router Troubleshooting, flood attack on lan ports..
Post by: FurryNutz on February 15, 2019, 01:24:40 PM
What was the details of that IP address listed in the logs?
Title: Re: Router Troubleshooting, flood attack on lan ports..
Post by: Commissar on February 15, 2019, 01:45:17 PM
What was the details of that IP address listed in the logs?

It says its a cloudflare
Title: Re: Router Troubleshooting, flood attack on lan ports..
Post by: FurryNutz on February 15, 2019, 01:54:01 PM
Are you using any custom DNS on the router or do any of your devices use cloudfare DNS, 1.1.1.1?
Title: Re: Router Troubleshooting, flood attack on lan ports..
Post by: Commissar on February 16, 2019, 03:26:59 AM
Are you using any custom DNS on the router or do any of your devices use cloudfare DNS, 1.1.1.1?

no, its set on " Receive DNS from ISP"
Title: Re: Router Troubleshooting, flood attack on lan ports..
Post by: FurryNutz on February 16, 2019, 11:52:54 AM
Do you have anything or a device that has services from this address?
Do you have a different router that you can test with?
Title: Re: Router Troubleshooting, flood attack on lan ports..
Post by: alphahydrae on February 22, 2019, 03:44:50 AM
I have the same issue. I posted it in reddit/r/techsupport.
Here is the link: https://www.reddit.com/r/techsupport/comments/as7w89/my_pc_location_is_incorrect_when_router_is/

@Commissar, have you checked your Speedtest? My Speedtest gives me different recommended server. Try to check yours. Im from PH but Speedtest tells me that recommended server is either India, Russia, Canada, or some other Eastern EU which causes the internet speed to slow down since its far away from where I am.

There is no issue when router is disconnected from the ISP Router-Modem. Issue only occurs when this same DLINK DIR 605L is connected to it and I just experienced this recently this Feb as well.
Title: Re: Router Troubleshooting, flood attack on lan ports..
Post by: FurryNutz on February 22, 2019, 06:29:25 AM
Link>Welcome! (http://forums.dlink.com/index.php?topic=49573.0)


I have the same issue. I posted it in reddit/r/techsupport.
Here is the link: https://www.reddit.com/r/techsupport/comments/as7w89/my_pc_location_is_incorrect_when_router_is/

@Commissar, have you checked your Speedtest? My Speedtest gives me different recommended server. Try to check yours. Im from PH but Speedtest tells me that recommended server is either India, Russia, Canada, or some other Eastern EU which causes the internet speed to slow down since its far away from where I am.

There is no issue when router is disconnected from the ISP Router-Modem. Issue only occurs when this same DLINK DIR 605L is connected to it and I just experienced this recently this Feb as well.