Fuadach ródaire DNS agus Comhréiteach ar Aghaidh ar Phoirt UPnP: Geata ISP ag díriú ar Fhreastalaí DNS Rogue, 30-30-30 vs. Athshocrú Crua NVRAM, agus DoH/DoT Criptithe¶

Ag oscailt do ríomhaire glúine nó smartphone ar do theach nó oifig bheag Wi-Fi amháin a fheiceáil falsa "Chrome / Windows Critical Update Required" preabfhuinneoga, scáileáin tairseacha faoi chuing ag lorg do ródaire nó do phasfhocal ríomhphoist, NET::ERR_CERT_AUTHORITY_INVALID Rabhadh teastais TLS ar láithreáin ghréasáin baincéireachta, nó fáil amach gurb é do ródaire WAN / DHCP tá an chumraíocht athscríofa go ciúin chun a chur in iúl do eachtrannach bradacha DNS Seoladh IP (nó d'oscail an iliomad neamhúdaraithe UPnP Is comhréiteach dian ar leibhéal an líonra é rialacha seolta ar aghaidh ag nochtadh do NAS, do cheamaraí agus do ríomhairí pearsanta don idirlíon poiblí. Nuair a dhéanann ionsaitheoir dochar do do ródaire Wi-Fi nó do gheata ISP (Netgear, TP-Link, ASUS, Linksys, D-Link, MikroTik, Ubiquiti, Arris, Comcast Xfinity, AT&T BGW, BT Smart Hub), rialaíonn siad an geata réamhshocraithe (192.168.1.1 nó 192.168.0.1) for every single device in your building simultaneously, including iPhones, Android phones, Smart TVs, work laptops, and IoT hubs that cannot install traditional antivirus software.

Worse, modern router malware families (VPNFilter, KV-Botnet, RaptorTrain, Volt Typhoon, ZuoRAT, Cyclops Blink, agus GhostDNS) use two distinct persistence mechanisms: some merely alter non-volatile NVRAM settings (DNS freastalaithe, CWMP / TR-069 remote management, and UPnP tables) via Cross-Site Request Forgery (CSRF) or default admin passwords, while advanced botnets stage payloads inside /tmp RAM or overwrite the Linux MTD SPI flash partitions. For related network and NAS compromises, read DNS hijacking, ISP router WAN reconfiguration, and captive portal spoofing, compromised home or small office NAS, DeadBolt ransomware, and UPnP shutoff, agus securing home routers and IoT devices. If your network compromise affects medical telemetry equipment or physical life-safety systems, switch immediately to cellular data and call your local emergency number (911 sna Stáit Aontaithe agus i gCeanada, 112 ar fud an Aontais Eorpaigh, 999 sa Ríocht Aontaithe) nó seiceáil ár n-eolaire de uimhreacha éigeandála.

Déan é seo anois¶

1. Disconnect your phones and laptops from the compromised Wi-Fi network immediately and DO NOT click "Update", "Install Certificate", nó "Verify Account" on any browser pop-up:
2. Why rogue DNS pop-ups are lethal: When a hijacked router points your DHCP DNS resolver to a malicious IP address, typing a normal domain name (or when your OS checks connectivity via msftconnecttest.com / captive.apple.com) redirects your browser to an attacker-controlled server hosting ClickFix / Lumma Stealer / Fake Chrome Update malware or a fake ISP login page. Switch your smartphones to cellular 5G/LTE immediately.
3. Pull the power plug on the router for 60 seconds FIRST (Stage-2 /tmp RAM Malware Flush), then connect a single clean computer via an Ethernet cable (with Wi-Fi turned OFF) to inspect and reset the router:
4. Why the FBI recommends an immediate power cycle: Most multistage router botnets (VPNFilter, KV-Botnet, ZuoRAT) cannot write their large active packet-sniffing and proxy binaries to tiny read-only SquashFS flash partitions; instead, they run Stage 2 and Stage 3 in volatile RAM (/tmp nó /var/run). Unplugging the power cord for 60 seconds immediately kills the active in-memory packet interceptor so you can safely access the router admin page to wipe Stage 1 persistence and reflash the firmware.
5. Know the truth about the "30-30-30 Hard Reset" vs. Modern Bootloader / NVRAM Factory Reset:
6. For decades, guides recommended the 30-30-30 reset (holding the reset pinhole for 30 seconds powered on, 30 seconds unplugged, and 30 seconds while plugging power back in).
7. Technical reality: The 30-30-30 Bhain an t-am go sonrach leis an oidhreacht ** Broadcom CFE (Common Firmware Environment) bootloaders ag rith DD-WRT. Ar nua-aimseartha ARM agus MIPS ródairí ag rith U-Boot (ASUS, TP-Link, Netgear, UniFi, GL.iNet), má dhéantar an chumhacht a dhíphlugáil agus an cnaipe Athshocraigh a shealbhú le linn tosaithe, caitheann sé an ródaire isteach i ** Bootloader TFTP / Crashed Recovery mód seachas glanadh NVRAM.
8. Chun monarcha-athshocrú NVRAM ar aon ródaire nua-aimseartha: fág an téad cumhachta plugáilte isteach agus an ródaire tosaithe go hiomlán, brúigh agus coinnigh an cuasán Reset cnaipe poll pionnaí go leanúnach ar feadh 10 go 30 soicind go dtí go splancaíonn gach soilse tosaigh LED ómra/dearg agus go n-atosaíonn an ródaire, ansin scaoiltear amach é.
9. ** Athnuaigh an íomhá firmware monarcha oifigiúil is déanaí (.bin / .chk / .trx / .img) a íoslódáil thar nasc ceallach glan SULA athcheangail an WAN (Idirlíon) Cábla Ethernet**:
10. Má dhéanann tú monarcha-athshocraigh ródaire agus é WAN tá an port fós plugáilte isteach san idirlíon poiblí, scanóirí botnet uathoibrithe (Shodan / Censys scripteanna ollshaothrú dírithe WAN calafoirt bainistíochta 8080, 8443, 7547 TR-069, nó UPnP SOAP) is féidir leo leas a bhaint as leochaileacht nó as mainneachtain nach bhfuil paiste admin/admin logáil isteach laistigh de 90 soicind ón atosaigh.
11. Íoslódáil an comhad firmware is déanaí ag baint úsáide as hotspot do ghutháin ar dtús, díphlugáil an WAN cábla ón ródaire, déan an athshocrú mhonarcha, uaslódáil an comhad firmware as líne trí 192.168.1.1, socraigh pasfhocal riaracháin nua 20-charachtar, agus ansin amháin plug an WAN cábla idirlín ar ais i.
12. Díchumasaigh UPnP (Universal Plug and Play), NAT-PMP, Remote WAN Management, agus WPS láithreach i socruithe an ródaire:
13. Tarlaíonn nócha faoin gcéad de na comhréitigh neamhúdaraithe maidir le cur ar aghaidh calafoirt toisc **UPnPTá ** cumasaithe de réir réamhshocraithe ar ródairí tomhaltóra: is féidir le haon teilifís chliste, ceamara IoT nó script bhrabhsálaí ionfhabhtaithe ar do líonra áitiúil seoladh neamhfhíordheimhnithe a sheoladh UPnP IGD SOAP Iarratas XML (AddPortMapping) to 192.168.1.1:1900 treoir a thabhairt don ródaire calafoirt balla dóiteáin seachtracha a oscailt díreach chuig do NAS inmheánach (port 5000/445) nó Windows PC (port 3389 RDP).
14. Fliuch an áitiúil DNS Cache agus ARP Cache ar gach feiste Windows, Mac, iPhone, agus Android, agus cumasaigh Encrypted DNS (DNS-over-HTTPS / DoH nó DNS-over-TLS / DoT):
15. Fiú amháin tar éis duit an ródaire a dheisiú, leanfaidh do ríomhairí glúine agus do ghutháin ag ródú tráchta chuig seoltaí IP an ionsaitheora go dtí go rachaidh a TTLanna DNS i dtaisce in éag nó má shruthlaíonn tú de láimh na taisce OS agus brabhsálaí DNS (ipconfig /flushdns).

Decision tree: diagnosing and eradicating a router DNS hijack or UPnP compromise¶

Follow this network forensics workflow to confirm the hijack, eradicate persistence, and harden your gateway:

flowchart TD
    Start["Suspicious Redirects, Certificate Warnings, Fake Update Pop-Ups, or Slow/Hijacked Traffic on Wi-Fi"] --> AuditDNS["CÉIM 1: Rith 'nslookup google.com' & Seiceáil an Ródaire WAN/DHCP DNS IP + UPnP Port Ar Aghaidh Tábla"]

    AuditDNS --> IsHijacked{"An dtaispeánann Ródaire IPanna DNS Anaithnid Eachtrannaigh NÓ Port Neamhúdaraithe UPnP ar Aghaidh?"}

    IsHijacked -->|"NÍL: Tá an ródaire DNS & na Poirt Glan, Níl Atreoruithe ag Gléas AMHÁIN"| LocalMalware["Tá Comhréiteach Áitiúil don PC/Fón Aonair Sin -> Seiceáil Comhad 'Óstaigh', Eisínteachtaí Mailíseacha Chrome, nó Próifíl Rogue Proxy/VPN"]

    IsHijacked -->|"TÁ: Athraíodh DNS an Ródaire, Oscailte Bainistíocht WAN, nó Rialacha Rogue UPnP i Láthair"| UnplugWAN["CÉIM 2: Díphlugáil Cábla WAN (Idirlíon) ón Ródaire + Ródaire Rothaíochta Cumhachta ar feadh 60 Soicind go dtí Mal-earraí RAM '/ tmp' a shruthlú"]

    UnplugWAN --> EoLCheck{"An Geata faoi Úinéireacht ISP é an Ródaire NÓ Do Ródaire Miondíola Féin?"}

    EoLCheck -->|"Móideim / Ródaire ar Cíos ISP (Comcast, AT&T, Spectrum, BT, Virgin, Rogers)"| ISPGateway["1. Coinnigh Pinhole Athshocraigh Fisiciúil 15-30s. 2. Athraigh Pasfhocail Riarachán & Wi-Fi + Díchumasaigh UPnP. 3. Má tá TR-069 / Firmware i gContúirt, Éileamh Láithreach Babhtáil Crua-earraí In Aisce ag ISP Store"]

    EoLCheck -->|"Ródaire Miondíola: Tá an Múnla ag Deireadh a Ré (EoL / Gan Nuashonruithe Firmware i 2+ Blianta)"| ReplaceRouter["NÍOS PLUGHÁIL go buan & CRUA-BHEARTA A SHÁSÁIL: Déanfar Ródairí EoL nach bhfuil Paistí a Ath-Haiceáil laistigh de Uaireanta Tar éis iad a Athnascadh le WAN"]

    EoLCheck -->|"Ródaire Miondíola: Múnla a Tacaítear go Gníomhach"| CleanReflash["1. Íoslódáil Firmware Oifigiúil is déanaí Thar Glan Hotspot Cellular. 2. Coinnigh Pinhole Athshocraigh 15-30s (Agus Powered On & As Líne). 3. Firmware Flash trí Ethernet -> Díchumasaigh UPnP & WAN Admin -> Socraigh DoH/DoT Criptithe"]

Céim 1: Conas a chruthú ar gabhadh tábla DNS nó UPnP do ródaire (Iniúchadh Fóiréinseach)¶

Sula scriosann tú an ródaire, tóg 2 nóiméad chun iniúchadh a dhéanamh ar cad a athraíodh ionas go mbeidh a fhios agat cé acu an nimhigh an t-ionsaitheoir amháin DNS (GhostDNS stíl) nó poirt curtha ar aghaidh chuig do líonra inmheánach freisin (UPnP / NAT cur isteach).

1. Iniúchadh a dhéanamh ar do fhreastalaithe DNS gníomhacha ón líne ordaithe (nslookup / scutil / resolvectl)¶

Oscail Críochfort nó Leid Ordú ar ríomhaire atá nasctha leis an líonra agus rith: - Windows (Command Prompt / PowerShell):

ipconfig /all
nslookup example.com

scutil --dns | grep 'nameserver\[[0-9]*\]'

resolvectl status

Déan comparáid idir an DNS Servers Seoladh IP a chuir do ródaire ar ais in aghaidh an tábla seo de chumraíochtaí dlisteanacha vs. fuadaithe:

2. Auditing your Router's UPnP agus Port Forwarding / Virtual Server Table¶

When you log into your router's admin interface (http://192.168.1.1, 192.168.0.1, 10.0.0.1, nó 192.168.50.1), go to Advanced -> NAT Forwarding / Port Forwarding / UPnP: - Look at the UPnP Portmap Table (active UPnP leases): - Legitimate gaming consoles temporarily open high UDP ports (such as UDP 3074 for Xbox/Call of Duty). - Signs of active compromise: If you see UPnP rules forwarding external TCP ports to Port 445 (SMB),Port 3389 (Windows Remote Desktop / RDP),Port 22 (SSH),Port 5000 / 5001 / 8080 (Synology / QNAP NAS),Port 554 (RTSP Security Cameras), or Port 1080 / 9050 (SOCKS5 Proxy Botnet), malware inside your network (or a WAN UPnP SOAP exploit) has punched holes directly through your firewall. - Also check Advanced -> Security -> Remote Management (WAN Access) and Firewall -> DMZ: - Verify that Remote Management (Web Access from WAN) is DISABLED (OFF) and that DMZ Host is DISABLED (Blank / 0.0.0.0). Attackers who breach a router almost always turn on Remote Management on Port 8080 / 8443 or place an internal IP into the DMZ so they can get back in later.

Phase 2: Step-by-step router eradication, NVRAM reset, and offline firmware reflash¶

Ná logáil isteach go simplí i ródaire agus clóscríobh i mbaol 8.8.8.8 ar ais isteach sa bhosca DNS gan é a athshocrú agus a athflashing: má chuir an t-ionsaitheoir plandáil a cron post, modhnaithe dnsmasq.conf, cumasaithe TR-069 (CWMP) uathchumraíocht bradacha, nó leas a bhaint as leochaileacht firmware gan phas, tiocfaidh an socrú DNS bradacha ar ais 10 nóiméad ina dhiaidh sin.

Déan an téarnamh seomra glan 6 chéim seo:

Step 1: Download the latest official firmware and tools BEFORE disconnecting the internet¶

1. Ag baint úsáide as smartphone ar shonraí ceallacha (le Wi-Fi múchta) nó ríomhaire ceangailte le hotspot do ghutháin:
2. Féach ar an ngreamán fisiceach ag bun do ródaire agus léigh an Uimhir Mhúnla cruinn AGUS an Athbhreithniú Crua-earraí (Ver: 1.0, v2, v4.20). (Flashing Hardware v1 firmware onto a v2 is féidir leis an ródaire bríce a dhéanamh air.)
3. Téigh go díreach chuig láithreán gréasáin tacaíochta oifigiúil an mhonaróra (asus.com, tp-link.com, netgear.com, linksys.com, ui.com) and download the latest firmware .zip archive to your computer.
4. Sliocht an .zip file so you have the raw .bin, .chk, .trx, nó .img firmware file ready on your Desktop.

Step 2: Isolate the router from the WAN (Internet) and flush volatile RAM¶

1. Unplug the WAN Ethernet cable (the cable coming from your fiber ONT nó móideim cábla isteach sa gorm / buí Internet / WAN port ar do ródaire).
2. Unplug all LAN Ethernet cables except for one clean laptop/PC (with its Wi-Fi turned OFF).
3. Unplug the router's power cord from the wall for 60 full seconds: This completely discharges the motherboard capacitors and destroys any Stage-2/Stage-3 malware running in /tmp RAM.

Step 3: Perform a proper Hardware NVRAM Factory Reset (And why to avoid 30-30-30 on modern routers)¶

1. Plug the router's power cord back in (keep the WAN internet cable unplugged) and wait 2 full minutes until the router finishes booting up completely.
2. Using a paperclip or SIM-ejector tool, press and hold the recessed Reset pinhole button on the back of the router:
3. Standard U-Boot / Modern Linux Routers (ASUS, TP-Link, Netgear, Linksys, Ubiquiti, Synology, Eero): Hold the Reset button continuously for 15 to 30 seconds while the router is powered on until all LED lights blink rapidly or turn amber, then release the button and wait 3 minutes for the router to reboot with a wiped NVRAM partition.
4. ASUS Specific "Hard Factory Reset" (NVRAM + /jffs Partition Wipe): On ASUS routers (RT-AX, RT-BE, GT-AX sraith), is féidir le malware nó scripteanna bradacha a cheilt laistigh den leanúnach/jffs splancdheighilt a mhaireann gnáth-athshocrú. an dá cheann a ghlanadh NVRAM agus /jffs ar ródaire ASUS:
   1. Múch cumhacht an ródaire.
   2. Brúigh agus coinnigh an ** fisiciúilWPS cnaipe** (ní an cnaipe Athshocraigh).
   3. Agus an ** á shealbhúWPS cnaipe**, cas an chumhacht ródaire ** ON**.
   4. Coinnigh a shealbhú WPS ar feadh 15 soicind go dtí go dtosaíonn an Power LED ag splancadh go tapa, ansin téann sé dorcha / atosaigh, agus scaoiltear. Feidhmíonn sé seo leibhéal crua-earraí NVRAM + /jffs scriosadh.

Céim 4: Athnuaigh an firmware as líne agus glasáil síos an eitleán riaracháin¶

1. Ar do ríomhaire atá nasctha le Ethernet, oscail fuinneog bhrabhsála phríobháideach/incognito agus téigh chuig IP réamhshocraithe an ródaire (http://192.168.1.1, 192.168.0.1, nó 192.168.50.1).
2. Críochnaigh an draoi suiteála tosaigh ** as líne** agus socraigh láithreach Pasfhocal Riarthóra uathúil 20-charachtar (ná húsáid do phasfhocal Wi-Fi mar phasfhocal Riaracháin an ródaire riamh).
3. Go to Administration / System -> Firmware Upgrade -> Manual / Local File Upload, roghnaigh an comhad firmware oifigiúil a d'íoslódáil tú i gCéim 1, agus flash é. Fiú má tá an uimhir leagain mar an gcéanna leis an méid a bhí suiteáilte cheana féin, forscríobhann reflashing an rootfs íomhá an chórais agus fíoraíonn sé síniú firmware cripteagrafach.
4. A luaithe a atosaíonn an ródaire tar éis splanc an fhirmware, fíoraigh na 6 Shocrú Crua Éigeantach seo sula bplocálann tú an cábla idirlín arís:
5. UPnP (Universal Plug and Play): Socraigh goDISABLED / OFF.
6. Remote Management (WAN Web Access / HTTPS from WAN / SSH from WAN): Socraigh goDISABLED / OFF.
7. TR-069 / CWMP (Ar Ródairí Miondíola): Socraigh go DISABLED / OFF (mura n-éilíonn geata ISP snáithíneach é).
8. WPS (Wi-Fi Protected Setup UAP / cnaipe brú): Socraigh go DISABLED / OFF.
9. Wi-Fi Security: Socraigh go WPA3-Personal (nó WPA2/WPA3-Personal AES; riamh WPA/TKIP nó WEP) le pasfhrása Wi-Fi úrnua.
10. WAN DNS Server: Socraigh DNS Príomhúil go ** de láimh1.1.1.1** (Cloudflare) nó 9.9.9.9 (Quad9 Malware-Blocking DNS) agus DNS Tánaisteach go 1.0.0.1 nó 149.112.112.112 (agus cumasaigh DNS-over-TLS / DoT ar an ródaire má thacaítear leis).
11. Plug an WAN cábla (Idirlíon) ar ais isteach sa ródaire.

Céim 3: Taiscí DNS nimhithe a shruthlú ar gach feiste agus DNS Criptithe a chumasú (DoH / DoT)¶

Fiú nuair a bhíonn do ródaire 100 faoin gcéad glan, d’fhéadfadh go mbeadh taifid DNS nimhiúla ar aon ríomhaire glúine, deasc nó fón cliste a cheangail le linn an fhuadaigh fós (TTL suas le 7 lá), áitiúil modhnaithehosts comhad, nó linn soicéad brabhsálaí nimhe.

Céim 1: Seiceáil an áitiúil hosts comhad agus sruthlaigh taisceanna DNS Brabhsálaí OS +¶

1. Fíoraigh nár scríobh bogearraí mailíseacha iontrálacha bréige isteach i logánta do ríomhaire hosts comhad:
2. Windows: Oscail Notepad mar Riarthóir agus oscail C:\Windows\System32\drivers\etc\hosts. Gach líne i réamhshocraithe glan hosts file should start with # (comments). Delete any line mapping real domain names (google.com, microsoft.com, banking sites, or antivirus domains) to strange IP addresses.
3. macOS / Linux: Check cat /etc/hosts in Terminal.
4. Fliuch an Córas Oibriúcháin taisce DNS agus ARP:
5. Windows (Run Command Prompt as Administrator):

   ipconfig /flushdns
   ipconfig /release
   ipconfig /renew
   arp -d *
   

6. macOS (Terminal):

   sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
   

7. iPhone / iPad / Android: Turn Airplane Mode ON for 15 seconds, then turn it OFF, and Forget and Rejoin the Wi-Fi network.
8. Flush Chrome, Edge, agus Brabhsálaí Inmheánach Brave DNS & Taisce Soicéad:
9. Chromium browsers maintain their own internal DNS cache independent of Windows/macOS.
10. Open Chrome, Edge, or Brave -> type chrome://net-internals/#dns in the address bar -> click Clear host cache.
11. Next, click Sockets in the left sidebar (chrome://net-internals/#sockets) -> click Close idle sockets and Flush socket pools.

Step 2: Enable Encrypted DNS (DNS-over-HTTPS / DoH agus DNS-over-TLS / DoT) so a router can NEVER hijack your DNS again¶

Traditional DNS (UDP port 53) is completely unencrypted and unauthenticated: any compromised router, ISP, coffee shop Wi-Fi, or hotel gateway can intercept your port 53 requests and forge fake answers. Enabling DNS-over-HTTPS (DoH) nó DNS-over-TLS (DoT) fillteann do cheisteanna DNS taobh istigh TLS 1.3 criptiúchán fíoraithe le teastas cripteagrafach, rud a chiallaíonn fiú má tá do ródaire hackáilte, ní féidir leis cuardach DNS amháin a léamh ná a athrú:

Céim 4: Iniúchadh a dhéanamh ar fheistí inmheánacha a nochtaíodh fad a bhí siad UPnP was open (NAS, Cameras, agus RDP)¶

If your router audit in Phase 1 revealed that unauthorized UPnP port forwards (or DMZ exposure) had been active before you reset the router, you must verify that attackers did not establish a foothold on an internal device while those firewall ports were open:

1. Check Home / Office NAS Appliances (Synology DiskStation, QNAP, TrueNAS):
2. Open your NAS control panel -> Security Advisor / QuFirewall / Connection Logs.
3. Look for failed or successful admin login attempts from foreign IP addresses, newly created administrator accounts, or unexpected scheduled cron tasks.
4. Inside the NAS settings (Control Panel -> External Access -> Router Configuration), uncheck all automatic UPnP router setup boxes so the NAS never attempts to open router ports again.
5. Check Windows PCs for RDP (Port 3389) Brute-Force Intrusion:
6. If TCP 3389 appeared in your router's UPnP table, open Windows Event Viewer (eventvwr.msc) -> Windows Logs -> Security and filter for Event ID 4624 (Successful Logon, Logon Type 10 RemoteInteractive) and Event ID 4625 (Failed Logon).
7. Disable Windows Remote Desktop (Settings -> System -> Remote Desktop -> OFF) unless accessed strictly through an encrypted peer-to-peer mesh VPN (Tailscale, WireGuard, nó ZeroTier).
8. Isolate Smart TVs, IP Cameras, and IoT Devices onto a Guest Wi-Fi Network (VLAN / AP Isolation):
9. The vast majority of internal UPnP router compromises originate from a cheap IoT camera, smart plug, or Android TV box on your main Wi-Fi network that joins a botnet and sends UPnP IGD commands to 192.168.1.1.
10. Enable your router's Guest Wi-Fi Network with Access Intranet / Allow guests to see each other and access my local network set to OFF (Client Isolation), and move all Smart TVs, cameras, robot vacuums, and smart appliances onto that isolated Guest SSID so they can never talk to your router's LAN management IP (192.168.1.1) or your work laptops again.

Ceisteanna coitianta¶

How did a hacker change the DNS settings inside my home router if they were not sitting in my house on my Wi-Fi?¶

Attackers compromise home and small-office routers remotely without ever being near your Wi-Fi using three primary methods: (1) Cross-Site Request Forgery (CSRF) and DNS Rebinding: Tugann tú cuairt ar ghnáthshuíomh Gréasáin ina bhfuil script fógraí mailíseach agus tú ar do ríomhaire baile; seolann an script sin iarratas POST HTTP go ciúin ó do bhrabhsálaí díreach chuig do ródaire áitiúil (http://192.168.1.1/apply.cgi), agus má úsáideann do ródaire fós an pasfhocal réamhshocraithe (riarthoir / riarthoir nó riarthoir / pasfhocal), athscríobhann an script freastalaithe WAN DNS do ródaire i 1 soicind. (2) Bainistíocht WAN nochta nó TR-069 (Port 7547/8080/8443): Aimsíonn scanóirí idirlín uathoibrithe ródairí le Riarachán cianda a fhágtar leochaileachtaí firmware oscailte nó gan phasáil agus instealladh orduithe go díreach ón idirlíon; agus (3) UPnP Nochtadh WAN: Nochtann ródairí níos sine nó míchumraithe a gcuid UPnP Deamhan gallúnach (calafort 1900/5000) chuig an gcomhéadan WAN, rud a ligeann do dhuine ar bith ar an idirlíon rialacha nó athrú calafoirt a chur ar aghaidh SocraighDNSSserver socruithe gan focal faire.

Cén fáth a dúirt tú nach n-oibríonn an "Athshocrú Crua 30-30-30" cáiliúil ar ródairí nua-aimseartha agus go bhféadfadh fadhbanna a bheith ann i ndáiríre?¶

Tá an 30-30-30 athshocrú (Athshocraigh ar feadh 30idí le cumhacht ar, 30idí le cumhacht as, agus 30í le linn cumhacht ar ais ar) a scríobh 20 bliain ó shin go sonrach le haghaidh Ritheann ródairí Linksys WRT54G DD-WRT on Broadcom CFE bootloaders. Ar beagnach gach ródaire nua-aimseartha a mhonaraítear le 12 bliain anuas (ASUS, TP-Link, Netgear, Linksys Velop, UniFi, MikroTik), holding down the physical Reset button while plugging in the power cord is the hardware trigger to halt normal boot and enter Bootloader TFTP Firmware Recovery Mode (áit a bhfuil an solas cumhachta ag blinks go mall ag fanacht le freastalaí TFTP, agus NVRAM is not erased at all). To properly wipe NVRAM back to factory defaults on any modern router, keep the power cord plugged in while the router is fully booted up, hold the Reset pinhole for 15 to 30 seconds until the lights flash, and let it reboot on its own.

If I disable UPnP (Universal Plug and Play) on my router for security, will it break my work Zoom calls, Netflix streaming, or web browsing?¶

No, disabling UPnP has zero effect on Zoom, Microsoft Teams, Netflix, YouTube, Slack, email, or web browsing. All standard internet applications initiate outbound connections from your device to the cloud server, which your router's Stateful Packet Inspection (SPI) NAT firewall handles automatically without UPnP. The only things that use UPnP are peer-to-peer multiplayer console games (PlayStation, Xbox, Nintendo Switch hosting lobbies), BitTorrent clients, and self-hosted servers (Plex) trying to accept unsolicited inbound connections from strangers on the internet. Leaving UPnP turned OFF is recommended by the NSA, CISA, agus FBI because it prevents malware or rogue IoT devices inside your home from secretly opening firewall ports to the public internet.

What if my router is a rented ISP combo modem/gateway (like Comcast Xfinity xFi, AT&T BGW320, or Spectrum) and it won't let me change the DNS servers or flash firmware?¶

Many ISP-supplied gateway modems lock down the WAN DNS fields in the web interface so customers cannot change them, and manage firmware exclusively over the ISP's coaxial/fiber headend via DOCSIS nó TR-069. If an ISP-rented gateway is exhibiting rogue DNS behavior or unauthorized port forwards: (1) Hold the physical recessed Reset pinhole on the back of the ISP gateway for 20 go 30 soicind chun iallach a chur ar mhonarcha a athshocrú agus úr DOCSIS / ONT íoslódáil bootfile ó do ISP; (2) Logáil isteach i d'app soghluaiste ISP (Xfinity, Bainisteoir Baile cliste, Mo Speictrim) chun pasfhocal do chuntais a athrú agus athbhreithniú a dhéanamh ar aon app-chumraithe Port Ar Aghaidh; agus (3) Cumraigh DNS criptithe (DoH / DoT) go díreach ar do ríomhairí glúine, fóin agus brabhsálaithe (mar a thaispeántar i gCéim 3 thuas), nó cuir an geata ISP isteach Mód Droichid / Mód Passthrough IP agus ceangail do ródaire miondíola slán féin taobh thiar de.

Treoracha gaolmhara¶

• DNS hijacking, ISP router WAN reconfiguration, and captive portal spoofing
• NAS baile nó oifig bheag i gcontúirt (QNAP/Synology), earraí ransom DeadBolt, agus múchadh seolta calafoirt UPnP
• Ródairí baile agus gléasanna IoT a dhaingniú
• Bréige CAPTCHA ClickFix PowerShell Win+R malware gearrthaisce agus leasúchán infostealer Lumma
• Baineann nial-lá leas as paistí éigeandála agus leithlisiú gléas i nDeireadh Ré (EoL).
• Uimhreacha éigeandála de réir tíre

Foinsí agus treoir oifigiúil¶

• An Ghníomhaireacht Náisiúnta Slándála (NSA) agus An Ghníomhaireacht um Chibearshlándáil agus Infreastruchtúr (CISA Comhbhileog Faisnéise Cibearshlándála - media.defense.gov): Cleachtais is Fearr chun do Líonra Baile a Dhaingniú (Díchumasú UPnP, WAN Riarachán, Oidhreacht WPS, agus Ródairí SOHO Deireadh Ré a Athchur).
• Biúró Chónaidhme Imscrúdaithe (FBI Fógra Seirbhíse Poiblí I-052518-PSA & KV-Botnet / RaptorTrain Comhairleoirí): Cibear-Aisteoirí Coigríche a Dhíríonn ar Ródairí Baile agus Oifige: Atosaigh Láithreach chun Pá-Ualaí RAM Céim-2 a shruthlú, Athshocraigh Monarcha, agus Prótacal Uasghrádú Firmware.
• Tascfhórsa Innealtóireachta Idirlín (IETF RFC 8484 - Fiosruithe DNS thar HTTPS (DoH) & RFC 7858 - Sonraíocht le haghaidh DNS thar Shlándáil Sraithe Iompair (DoT)): Fíordheimhniú Cripteagrafach agus Cosaint Ionracas an Taifeach DNS Stub-go-Athchúrsach.
• Comhairleoirí Slándála Oifigiúla ASUS, Netgear, agus TP-Link: * Crua-earraí NVRAM agus /jffs Nósanna Imeachta Athshocraigh Monarcha Deighiltí vs. U-Boot / CFE Stáit Aisghabhála TFTP*.