Hello, my two Arduinos systems (mega + enet shield) are being attacked every day. Except from logging the rip to abuseipdb i am helpless. Now I checked with a phone company for a fixed ip ($6/m) which should allow me reject all incoming cnx but my phone's, at the router's. Any better idea? Thanks!
Blockquote
I assume you've placed your MEGA in your DMZ?
what's running on it?
a fixed IP won't prevent bots to try your IP...
Whatever is attached to the net will be checked by all the nice things lurking in the wild. If you qualify this friendly bump beeing an attack then you should stay away from internet.
How many per day, per hour, per minute?
Put a linux machine on the line and keep Ethereal (wireshark) running. It will help show "who"...
https://www.linuxjournal.com/article/6842
@ J-M-L They are on my lan, behind the router. I am not sure what a dmz is. One sysrem manages home, the other the barn. A fix ip on my phone should allow me to tell the router to let in only connections coming from my phone and rejecting (reset) or ignor all other
@er_name_not_found attacks: ~3 per day total. Today: barn 3, home 0
@zwieblum So, you consider that i should ignore all these attacks. Note that, if they change ip every time, they may exhaust my log space so, if I have to live with it then i should also stop logging the ips
@xfpd wireshark runs on windows as well. what would this add? A simple mean to reply immediately by a ping of death or syn flood towards the attacker could at least make me feel better.
did you do any port forwarding on your router or did you leave the router as it was?
whois shows registrant, registrar, host, country, IP, domain and email which can be blacklisted. Stalking and retaliation are illegal over commercial wirelines.
Port forwarding. I guess the attackers run port scanning and hit forwarded ports. All the attackers ips are already listed in abuseipdb
Aehm, you are not under attack. Anyway, rethink your architecture if it bothers you: why do you want to call into your LAN from outside? Why from all over the internet including hades? Do you use encrypted communication? Public/private keys or preshared keys? One time passwort? Or nothing at all - then revisit your security architecture ... sorry, this rabbit hole is deep and scary and monsters lurk around every corner 
pretty common.
You said mega + enet shield so I guess nothing is crypted.
The question is what's your security risk. Are you keeping your bitcoins on there or it's just the outside temperature you can check from an HTTP page?
Hackers will never use their “own” infrastructure (computers, wan links, you name it) launch attacks. They hack into someone else’s computer/server and create a bot that launches the attack. If you try such an attack (or retaliation) from home, your ISP will terminate your service. Read your contract. Also, I think it would be illegal, depending of your country’s laws.
It is hard to know where the hacker is, and they are always on the move.
Use of the low orbit ion cannon is ill-advised.
@J-M-L No bitcoin but they can disarm the alarm, open the portals to the yard and to the garage, flood the garden, acrivate ir heater and burn the house?. Depends in how far i am. The only protection is a good password
OK - so it would deserve a better security.
No… without https your password is open for interception over the network…
your challenge is the choice of hardware (no https) and weak network infrastructure as you route blindly all the requests to the Mega.
First thing to do would be not to expose the critical resource over the internet. Insert an ESP32 in between. The ESP32 would do https, offer filtering (authenticate the requester) before routing the request (may be not over http) to the MEGA
don't expose your Arduino to the wild wild web.
If YOU need access to your Arduino from outside, make a VPN connection to your home network.
Should this prevent someone from accessing my inos by shooting at my homes ip and scanning ports?