Hi @j1979 

Thanks for posting in our business forum.

j1979 wrote

  @Clive_A 

 

10 mins is fine imho any shorter fills the events log in a few days.  

 

With wireguard I don't know if UDP is only used for the tunneling and TCP is used elsewhere.   But the attacks were coming in my case from the local devices as they were still coming even if I added a firewall rule to block all incoming globally.

 

So each device was trying to ping the remote wireguard servers and the router /oc200 was picking it up as an attack.   i'm sure of that.  If you're still not convinced then maybe just keep it in mind as a possible line of questioning when users are coming with similar issues.

 

Will see your feedback if is helpful to others. At least I should see some new feedback based on your suggestions before I take this further to analysis. But so far no clear evidence indicating this relates to TCP SYN yet.

Thanks for bringing this up from a new perspective and giving a possible solution or cause. Will keep an eye on this.

Hi  @j1979 

j1979 wrote

@Clive_A 

 

Just another update,  Im 100% sure now this is, in my case caused by the  PersistentKeepalive=   option in external wireguard peer profiles (not the builtin wireguard in the er605 router).

 

The reason im now completly sure, is that the only time I now get the TCP SYN attacks event is when my girlfriend comes over to stay and uses the wifi,  she still has a wireguard peer config on her phone that still uses the persistantkeepalive.

 

 

Got some questions for you.

If your persistenkeepalive = 25 (seconds). So, why does it show hundreds of the TCP SYN in 10 minutes?

Let's say it does not meet the math results in this situation.

600 secs, you should probably get 24 TCP SYN attack. But you get hundreds in the log?

How many attacks do you get in the log every 10 minutes? I assume you still get hundreds? Or under 100 times?

If you can answer this and let me know it is under 100 times every 10 minutes, then we may think it somehow relates. But only until I got an answer from you to confirm this.