Remote Access on random ports from nefarious regions

General Discussions
1

I’m noticing a bunch of LAN Access From Remote entries in my Netgear r8000 logs once I configure remote access. The public ports that show up in the logs are different from the ones I’ve configured for port forwarding, and the IP addresses originate from random places like UAE and easterneurope-istan. I’m running 2x Plex servers on 2 different Windows PCs on my LAN - each identified by a different port, and remote access is working fine. Should I be concerned about these log entries? Thanks!!

cm02xb31890c.png892×479 264 KB

2

If you cannot identify the source, be concerned.

  1. Change your password and ‘log out all devices’ at plex.tv (account section)
  2. change to non-standard ports (32400 is well known now)
3

@ChuckPA said:
If you cannot identify the source, be concerned.

  1. Change your password and ‘log out all devices’ at plex.tv (account section)
  2. change to non-standard ports (32400 is well known now)

Thanks Chuck - as per my note, I’m using non-standard ports. The sources appear to be using random ports to access my Plex servers - they are not the ingress ports I’ve identified to forward. What’s up with that?

4

I apologize, I didn’t check through all the hosts. They are Plex’s servers on Amazon. I didn’t take region into consideration. Having checked further, those are the servers for your region which periodically check your connectivity.

5

@ChuckPA said:
I apologize, I didn’t check through all the hosts. They are Plex’s servers on Amazon. I didn’t take region into consideration. Having checked further, those are the servers for your region which periodically check your connectivity.

I wondered, thanks. I still don’t understand how they could be getting to my servers with the ports they are using - UPNP is disabled, so it looks odd to me. That said, these only show up when remote access is enabled - regardless of my port forwarding rules - which seems to reinforce your response that this is expected traffic from Plex servers.

Appreciate the response.

6

PMS does a routine ping test to verify your server, which you enabled for Remote Access, is still at the IP address and reachable. It’s a simple “Hello, are you still at this port?”