A temporary fix for a mirai-infected router is to reboot the device, but as soon as the router has been rescanned by mirai it will be infected again.

In reply to a post by BatBoy:

In reply to a post by wolvesmad:

Thought the firewall on the HG612 was capable?

The HG612 is a modem. What router were you using with it?

The 612 is a router that has a bridge mode. They arrive from Openreach in bridge but it's just a drop down to put them in router mode.

To be more exact they arrive with an interface in router mode, the external management VLAN Openreach use for telemetry and firmware updates, and the regular Internet interface in bridge.

In reply to a post by Ignitionnet:

The 612 is a router that has a bridge mode. They arrive from Openreach in bridge but it's just a drop down to put them in router mode.

... after you've disabled the firewall which is set to bar access from the WAN or the LAN

They have to be flashed with a custom firmware indeed before they can be managed by users, though that is trivial.

Line is still fine running on the Home Hub 5.

Is the HG612 actually infected? Is it written off? I want to get it back up and running as it's far more stable than the HH5.

Home Hub 5.

It's a modem yes, but it has a built in firewall.

If you've unlocked the hg612, put it back to locked state via a hardware reset and then see if it's stilll insecure - using a router if necessary. If it's ok in factory state, then you should try unlocking it again, its possible the original flash wasn't done properly.

I've done a factory reset on it and I can now access it etc.

I'll be using it with the Home Hub, do I leave the firewall on, on the HG612?

Disable DHCP, QOS and NAT?

In reply to a post by wolvesmad:

I've done a factory reset on it and I can now access it etc.

I'll be using it with the Home Hub, do I leave the firewall on, on the HG612?

Disable DHCP, QOS and NAT?

In that case you shouldn't need to change anything on the HG612 and ensure the firewall is switched on the Home Hub.

Edited by deleted (Sun 30-Apr-17 14:25:35)

Plugged the H612 back in, in it's default state and all has been fine until 20:41 when the internet dropped.

Looks like the HG612 rebooted? So I checked the Home Hub 5's log and saw this :-

20:41:36, 01 May.
(27887.730000) Ethernet is up
20:41:35, 01 May.
(27886.810000) Ethernet is down after 367 minutes uptime
20:41:35, 01 May.
(27886.800000) PPPoE is down after 366 minutes uptime [Waiting for Underlying Connection (WAN Ethernet -​ Up)]
20:41:33, 01 May.
(27883.990000) PPP LCP Send Termination Request [User request]

What's that PPP LCP termination request?

The HG612 has been a really solid modem with nearly 100 days uptime until recently.

Edited by wolvesmad (Mon 01-May-17 22:35:57)