BT modem on SSE

As per a previous thread, I suspect my SSE-supplied TG589 router has been compromised. Due to the limitations of the GUI-only interface, its difficult to determine this, but the symptoms seem to point towards this:

Internet activity lights blinking like a bad 70's disco, even when all devices are inactive/off

2.4Ghz wireless enabled but not seen by any device including Insider and netstumbler (this network worked fine for the first few months).

Router shows the 2.4Ghz wifi enabled and with a strong 130mb data rate, no overlapping networks

5Ghz wireless network enabled, works, but only at 54-80MB, devices often lose connectivity/network drops out. Symptomatic of the router working at 100% peak load

Traffic stats show received data at 3.6TB (!), but transmitted data at 3.8 TERRABYTES. WTAF!!! We don't upload anything. We watch a fair bit of streamed video, well, the other half does, but thats from youtube and often at SD resolution. And there is no way that that would generate almost 4TB of ACK packets

I'm going to upgrade the firmware with that for the v2 router (its confirmed working), and if that doesn't solve it, a new router from SSE.

But, I'm more than tempted to replace the router with a modem and OPNSense firewall. Question is, which modem? Will the old BT Openreach VDSL Fibre modem work, and which is better, the Huawei or ECI model? ISTR that might depend on the cab, so fwiw my postcode is G20 9QS if anyoen is able to check the cab.

Am impressed with SSE fibre - 18months for £20/month inc line rental, free landline calls, solid 78/20 connection, no caps, no throttling, no issue. Just need to solve the niggles!

All help appreciated!

Huawei HG612 is best (cabinet matching is a bit of an old wives tales, the Huawei usually wins)

On next router, double check that no ports are visible on the WAN side, as routers get compromised usually via remote admin options, or a bit of malware running on a PC on the LAN side, so malware detection on PC will help there.

Assuming you have the correct credentials for your SSE account, OPNsense should work - though I have serious issues with Franco's attitude, also OPNsense have managed to ship some broken code in the past in supposedly stable releases (one stable release had broken VLANs, for example).

I would seriously suggest you consider going for pfSense instead; OPNsense is a fork of pfSense. As both OPNsense and pfSense are free to download and open source licensed, you could download both and see which you prefer.


Both the Openreach modems will work. If you have a jumbo capable NIC on your WAN interface, you can set MTU 1500 on the WAN interface and pfSense will use RFC 4638 (N.B. Intel NICs and possibly other brands only work with jumbo frames with a Gigabit link, so you might need to put a Gigabit switch between the WAN NIC and the modem). IPv6 should be supported if SSE are providing IPv6.

Edited by deleted (Thu 02-Mar-17 14:39:57)

A huawei it is then, plenty on ebay.

WAN ports were locked down as soon as it came out of the box, as was the remote admin port. Double checked with ShieldsUP! and various other on-line tools, again re-checked again over the last few days.

If there is something internally, its going to be a PITA as nothing we have here detects anything... as far as I know, Panasonic TV/BD do not "phone home". But again, sticking a box between the LAN and the WAN will enable me to see just what is talking on the network.

Thanks!

Hello Dave, been almost ten years

In reply to a post by David_W:

Assuming you have the correct credentials for your SSE account, OPNsense should work - though I have serious issues with Franco's attitude, also OPNsense have managed to ship some broken code in the past in supposedly stable releases (one stable release had broken VLANs, for example).

SEE credentials are straightforwards, once one works out that which of the two provided passwords is for the broadband, and which is for something else.

Borked code, not good, especially when they claim code is tested - unlike PFSense!

I would seriously suggest you consider going for pfSense instead; OPNsense is a fork of pfSense. As both OPNsense and pfSense are free to download and open source licensed, you could download both and see which you prefer.

I've looked at both, and guessed it was pretty much horses for courses, OPS being a fork. Initially was going with PFSense for reasons not relevant here, but I was taken with the feature set in OPS, particularly its ability to use multi-cores. Whichever I use, it will be running on an old N40L microserver, which only has a dual-core AMD. I know its not the best hardware for the task, but on-board RAID and the 4 drivebays allow me to use some old SATA drives for caching and log-storage, it has two PCI-e slots so I can the additional NIC I need, and if necessary, a third.

Thanks again. BTW, are you still climbing in the Lakes? I moved back up there 5 years ago, then moved again last year... never seem to be able to stay there!

Could just be someone doing something that is chewing traffic constantly probing the router. You have tried turning off the Wi-Fi?

I'd go with the Huawei too.

I have a Huawei on my SSE line, using a Mikrotik RB2011 as my router and Ubiquiti UniFi AC Lite for wireless

Have a couple more tests to complete before I take the nuke option, disabling wifi is one of them (as is adding a separate AP so SWMBO can still access her daily dose of daily politics when I do so)

But, longer term I want to add border management / firewall anyway; with the number of tablets, phones, watches, devices, etc it will be interesting to see what is 'phoning home' - I knew I was right to buy Panny and not Samsung TV, for example.

In reply to a post by alewis:

A huawei it is then, plenty on ebay!

Don't be tempted to pay too much - max £20 should do it! I got mine for £19.99 BIN

Got mine for £15. Still on the lookout for a spare but don't really want to pay more than £15-20. Some asking silly prices because they are unlocked.