Applications Making Unusual Connections to Home Router and Localhost - Security Discussion

I have app snitch running in the background on my samsung phone and it's flagged a few apps (the Puffin browser is the latest one) making unusual unsecured connections to localhost on ports like 44541, 56566, 56582, etc.
It also picked up a connection from the Android System app attempting a connection to my routers IP address on port 67.
This is unrooted phone, no development going on. Is this normal, or should I be concerned?

Related

DNS Configuration For FTP (Public Seems Blocked?) Help Please!

I have had Serv-U and No-IP setup for the last couple of years without issues, but I recently upgraded to the new Clear (Clearwire) modem which seems to be blocking outside access.
Windows is configured, internet works, printer sharing works, internal sharing, etc. I can ping out, I can access my FTP server when I choose the local IP - but when I ping my external IP or try to put it in the browser it won't work.
I have forwarding setup, even bypassed my router but still I can't seem to gain access. I have included several photos, I believe there's an issue in my DNS or IP settings, I'm just unfamiliar with this router and my knowledge on IP shaping only goes so far.
I have an HTC Evo 4G, and I use my smartphones very very heavily, and without external access I'm pretty much in the dark while I'm away.
Any ideas would be greatly appreciated. I am also unsure if I have port forwarding setup correctly on my D-Link DGL-4500.

[Q] ConnectBot Port Tunneling

I have given up on working out VPN to my home network so I am giving SSH with ConnectBot a go. I can SSH to my home PC through my modem firewall ok now using key passwordless login (safest I understand) but I can't work out port forwarding.
Is it even possible to tunnel certain ports through my home Ubuntu PC using SSH? I want to access local web servers without opening them out on the Internet, for example sanzbd using the nzbair app or my other home media devices, web cams, etc.
I don't feel comfortable opening anything out on the Internet, even SSH makes me nervous although I understand it is fairly secure using key based log combined with a modem firewall and IDS, so I'd like to access my home network but securely.
I understand SSH is the next best option to VPN. But I can't find any guides.
I also have dyndns set up on my modem so (once that propagates I assume) I should be able to reliably SSH to my home PC.
I am very tired, so I'm sorry if this post is absolutely wrong.
I'm 90% certain you'd want to setup squid on your ubuntu box, so you can proxy through. Then connect with connectbot and then set up a portforward to send all port 80 traffic through on whatever port you got squid running on.
I think that should be at least a decent starting place.
Yeah I agree. I have the port tunelling working for sabnzbd now even if it's a bit flakey (drops out sometimes or the port forward can't be created).
So I'll read up on Squid and enable that on my home PC. That may cover a lot of general traffic from my phone too. I imagine a lot of apps use HTTP.

WiFi DNS issue

Currently running Sow Nice OJC on my G920T. I've been running into some odd WiFi issues...namely with DNS and addressing. At my and my girlfriend's house, WiFi is pretty much pointless as I get DNS errors. Her connection is using the standard Xfinity all-in-one modem/router which isn't configurable worth a damn...but her phone and tablet work fine via WiFi, as does my laptop. At my house I have my own modem and router; I have the DHCP server set up to use Google's public DNS servers. All my devices in my house work fine...Xbox, computer, even Chromecast...but for whatever reason my S6 runs into DNS errors which of course disables WiFi Calling as well.
I have tried running static IP and manually setting Google DNS as well as other DNS; it doesn't seem to help. I have also tried toggling airplane mode. I haven't experimented much with other connections that aren't Comcast, so I will include that in my troubleshooting. I am unsure if this is related to the issue I was having with connecting to my GoPro via WiFi.
Anyone else out there running Lollipop have DNS issues (or don't) and have found a solution? It isn't a huge issue at the moment as I have good signal at both places, but I would like to be able to use WiFi for the bandwidth...
Still working on this...it appears to be an IPv4 issue. All devices in my house happily get an ipv4 address alongside ipv6. Not the S6....it only uses ipv6.

One Plus 8 attacks my LAN VPN gateway...

This started a couple of days ago, and I have now mitigated it with a couple of firewall rules on the VPN gateway, as well as shutting down the dhcpcd server on that server (which I don't need anyway, and which probably should have been stopped long ago).
My LAN has a raspberry pi 4 running their debian firmware that is configured as a VPN gateway. It connects my LAN via ProtonVPN to the internet. This gateway is set up with a static IP address (192.168.2.49) on the LAN, and is configured to use another RPI on my LAN to get its DNS (192.168.2.50).
My one month old running OOS 11 OnePlus8 is rooted with magisk, and I have blocked most of the google stuff from the internet using afwall, and suspended non-essential system services using greenify. When connected to my LAN, the phone has a static IP address (192.168.2.71), has its gateway set to the VPN gateway (192.168.2.49), and its DNS to my local rpi DNS (192.168.2.50).
DHCP on my LAN is provided by my router (192.168.2.1).
WIFI on my LAN is provided by an enterprise-grade tp-link hotspot.
Starting a few days ago, for reasons mysterious, when the phone connects to the LAN, the VPN gateway would promptly go offline. Because I run it headless, I would be forced to reboot it - which made diagnosis a bit of a pain. Finally, I found a log entry on the VPN gateway that informed me that my OnePlus was trying to claim the ip address of the VPN gateway as its own (192.168.2.49) in spite of being set to use 192.168.2.71. This duplicate IP was causing dhcpcd on the VPN gateway to immediately take down its eth0 interface. This would break ALL connectivity because I have wifi on that RPI disabled.
Prior to this problem involving the OnePlus, that RPI had been up continuously for over 400 days, so it should certainly be considered to be reliable at the job it does and almost certainly the problem is with the OnePlus.
So, for some reason the OnePlus is trying to assert its assigned gateway address as its IP rather than the 192.168.2.71 that is set, at least in some packet that it uses to announce itself; once it is connected it works properly (which means the right IP address is being used).
I have deleted, then re-created the wifi connection profile and doing that did not cause the problem to go away.
I have another RPI VPN gateway on my IOT VLAN (192.168.24.0/24). No DHCP is available on the VLAN (a security measure), and I do have a profile for the phone that allows it to connect to the VLAN. It works without issue there, but then dhcpcd has been and remains shut down on that RPI. I suppose I could start dhcpcd on that server and see if the phone then breaks it too. I won't do this unless there is some merit to doing so...if it would help find the basic problem.
As I say, shutting down dhcpcd and blocking all dhcp traffic to/from the LAN VPN gateway mitigated the problem. But that the problem could occur at all says something is wrong, and I'm pretty sure it isn't a problem on my network.
This seems most likely to be a bug in OnePlus firmware, though why it would manifest after a month is a mystery to me. Does anyone have any insight? Or does anyone have any suggestions for another place on XDA where this post might more appropriately be placed?
I was pretty sure no one would have any idea about this. I have mitigated it by turning off dhcpcd on the VPN gateway and I am not inclined to do a deeper dive; I have too much else to do.

Assigning a static IP address to a phones hotspot

How can I assign a static IP address to my phones hotspot?
I use the hotspot on my Samsung M31 to connect my laptop running Windows 10 to the internet.
I also have Oracle's Virtual Box VM running a few test websites on the laptop on Ubuntu Server 22.04, which need a static IP address to access.
A few days back when I ran ipconfig at the Windows command prompt, it showed my wireless IP address as 192.168.166.135. Today, it show as 192.168.35.125. Meaning, all my sites are now broken. Is there a way to stop the hotspot from changing IP addresses?
Can someone please help?
Thanks,
normanscr said:
How can I assign a static IP address to my phones hotspot?
I use the hotspot on my Samsung M31 to connect my laptop running Windows 10 to the internet.
I also have Oracle's Virtual Box VM running a few test websites on the laptop on Ubuntu Server 22.04, which need a static IP address to access.
A few days back when I ran ipconfig at the Windows command prompt, it showed my wireless IP address as 192.168.166.135. Today, it show as 192.168.35.125. Meaning, all my sites are now broken. Is there a way to stop the hotspot from changing IP addresses?
Can someone please help?
Thanks,
Click to expand...
Click to collapse
I don't know the answer to your question directly as your situation is more complicated than is mine but I will try to help in so much as you can at least check what your current settings are.
My setup is only similar to yours in that I have apps (such as vysor & scrcpy) on Windows which are expecting a static IP address from my phone. However, where my setup differs from yours is I'm not using my phone as a hotspot - the router is assigning the IP addresses.
However, maybe what I've learned by randomizing my MAC address on each connection can help you - where I say maybe - as I your situation is using the phone as a hotspot and mine is passively accepting the IP address handed to the phone by the router.
In Android 11, the phone's Wi-Fi radio MAC address can be randomized per SSID, in which case the "address reservation" feature of most routers (often incorrectly called "static" IP addresses) won't work as intended. Worse, in Android 12, in Developer options, you can set a switch to randomize the Wi-Fi radio MAC address of the phone on every connection, regardless of the SSID.
Hence, you have to set the "static" IP address request in the phone itself, so that the router will respect that request for a static IP address.
(As an extra complexity, my SSID broadcast is hidden for privacy reasons (not for security - but privacy), which complicates things only a tiny bit as you have to turn off auto-reconnect for privacy.)
See the images below where maybe (but maybe not!) this information will help you track down why in your (hotspot) case, this static IP address requrest isn't being honored in your hotstpot setup.
normanscr said:
How can I assign a static IP address to my phones hotspot?
I use the hotspot on my Samsung M31 to connect my laptop running Windows 10 to the internet.
I also have Oracle's Virtual Box VM running a few test websites on the laptop on Ubuntu Server 22.04, which need a static IP address to access.
A few days back when I ran ipconfig at the Windows command prompt, it showed my wireless IP address as 192.168.166.135. Today, it show as 192.168.35.125. Meaning, all my sites are now broken. Is there a way to stop the hotspot from changing IP addresses?
Can someone please help?
Thanks,
Click to expand...
Click to collapse
Hi ,
if You are the lucky owner of a rooted phone you can try this:
How do I assign a permanent static IP address to hotspot in Android 10
I would like to assign a permanent static IP address to hotspot in Android 10 (Unofficial LineageOS 17.1 for Natrium by LuK1337, rooted with Magisk v20.3 and updated to Jan 11, 2020 build). Now whenever I turn on the hotspot, it assigns a...
forum.xda-developers.com
To assign a static IP address to your phone's hotspot:
Go to your phone's settings and find the hotspot or tethering settings.
Look for the option to set the IP address as "Static" or "Manual."
Enter the desired IP address, subnet mask, gateway, and DNS server information.
Save the settings and restart the hotspot.
For more details, you can check out https://1921681.mobi/192-168-100-1/. Hope this helps.

Categories

Resources