Posted: Thu Nov 30, 2023 15:41 Post subject: Netgear R7800 keeps rebooting once a day
Netgear R7800 on build DD-WRT v3.0-r54248 std (11/29/23) that keeps rebooting once per day. I have syslog enabled and I don't see any entries around the time it reboots, only when it is restarting. When it reboots, it gets hung and doesn't boot. I have to manually pull the power cable, wait a few seconds, then plug back in. If I use the "Reboot Router" button in the GUI, I see the same behavior half the time. What can be causing this and what can I do to troubleshoot?
Is SFE enabled?
If so disable it and see if that fixes it..
Thanks, yes it was enabled and I just disabled and rebooted. I'll try this out for a few days. I have SSH enabled and I see a consistent amount of entries for the following in my syslog. Could brute forcing be causing my router to crash? The 180 IP is from China.
Nov 30 10:50:11 tnft authpriv.info dropbear[3881]: Child connection from 180.101.88.218:38928
Nov 30 10:50:12 tnft authpriv.info dropbear[3881]: Exit before auth from <180.101.88.218:38928>: No matching algo hostkey
Joined: 18 Mar 2014 Posts: 12923 Location: Netherlands
Posted: Thu Nov 30, 2023 16:44 Post subject:
You are posting in the wrong forum.
See the forum guidelines with helpful pointers about how to research your router, where and what firmware to download, where and how to post and many other helpful tips:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
No problem as I will move this thread to the appropriate forum
Joined: 16 Nov 2015 Posts: 6447 Location: UK, London, just across the river..
Posted: Thu Nov 30, 2023 17:52 Post subject:
danfratamico wrote:
bushant wrote:
Is SFE enabled?
If so disable it and see if that fixes it..
Thanks, yes it was enabled and I just disabled and rebooted. I'll try this out for a few days. I have SSH enabled and I see a consistent amount of entries for the following in my syslog. Could brute forcing be causing my router to crash? The 180 IP is from China.
Nov 30 10:50:11 tnft authpriv.info dropbear[3881]: Child connection from 180.101.88.218:38928
Nov 30 10:50:12 tnft authpriv.info dropbear[3881]: Exit before auth from <180.101.88.218:38928>: No matching algo hostkey
Is your SSh over WAN is active by mistake...or you are using it...than its ok...if not disable it...
On security settings page you can activate Limit SSH over WAN option and this will pospone some of the frequent try's
If you using your SSH over your local network only and this happens, it means there is a compromised device/zombie, that try's your SSH on your local network...and yes those do exist...
One good reason to have secure SSh key...also make sure you disable password for SSh access and use only secure key (ed25519 preferred)..I even password protect the key itself... _________________ Atheros
TP-Link WR740Nv1 ---DD-WRT 55630 WAP
TP-Link WR1043NDv2 -DD-WRT 55723 Gateway/DoT,Forced DNS,Ad-Block,Firewall,x4VLAN,VPN
TP-Link WR1043NDv2 -Gargoyle OS 1.15.x AP,DNS,QoS,Quotas
Qualcomm-Atheros
Netgear XR500 --DD-WRT 55779 Gateway/DoH,Forced DNS,AP Isolation,4VLAN,Ad-Block,Firewall,Vanilla
Netgear R7800 --DD-WRT 55819 Gateway/DoT,AD-Block,Forced DNS,AP&Net Isolation,x3VLAN,Firewall,Vanilla
Netgear R9000 --DD-WRT 55779 Gateway/DoT,AD-Block,AP Isolation,Firewall,Forced DNS,x2VLAN,Vanilla
Broadcom
Netgear R7000 --DD-WRT 55460 Gateway/SmartDNS/DoH,AD-Block,Firewall,Forced DNS,x3VLAN,VPN
NOT USING 5Ghz ANYWHERE
------------------------------------------------------
Stubby DNS over TLS I DNSCrypt v2 by mac913
