September 7, 20241 yr unraid version 6.12.10 The other day I had a notification from my router about a suspicious connection to my unraid server. The router blocked the connection and the message says I don't need to do anything further. I currently have a cloudflare tunnel setup to access nextcloud and immich remotely. What do you guys typically monitor to identify if someone has gained access into your server or local network?
September 7, 20241 yr 10 hours ago, xupal said: The other day I had a notification from my router about a suspicious connection to my unraid server. The router blocked the connection and the message says I don't need to do anything further. You have a time and date in this message. Was a legitimate attempt to establish a connection to your server at that time? (Say, from cloudflare tunnel....) Do you have a device on your LAN named 'SERVER'? If so... Google that IP address and see if it might have that IP address attempting to establish this connection. A very quick google indicates that it is based in Europe... You could also ask the person who attempted a connection what their Pubic IP address is. You can find using this website: https://whatismyipaddress.com/ Edited September 7, 20241 yr by Frank1940
September 8, 20241 yr Author 11 hours ago, Frank1940 said: You have a time and date in this message. Was a legitimate attempt to establish a connection to your server at that time? (Say, from cloudflare tunnel....) Do you have a device on your LAN named 'SERVER'? If so... Google that IP address and see if it might have that IP address attempting to establish this connection. A very quick google indicates that it is based in Europe... You could also ask the person who attempted a connection what their Pubic IP address is. You can find using this website: https://whatismyipaddress.com/ The unraid server is called SERVER on my network. No one that I know attempted to connect to it. I don't have my unraid login accessible from outside my network. When I checked it said the IP address was located in Romania.
September 8, 20241 yr 10 hours ago, xupal said: When I checked it said the IP address was located in Romania. This should be an indicator that someone is up to no good. Your router software apparently addressed the issue. Google shields up grc and find out how vulnerable you are.
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.