RRC Radio lost of connection every few days

[EA4MY]

Hello all
I'm running a TS480 since a few years ago. Everything worked fine until aprox two weeks ago. Since then the connection of the RRC radio fails every few days. I have made not any changes on the configuration, nor changed any hardware (router, etc). No changes here at all. No storms here or anything else that could damage the RRC. When, from inside the RRC radio LAN, I type in my PC the RRC IP what I get is what can be seen in the attached .jpg picture, that is, only the "structure" of the web site but whitout the left side menu. There appear a "Saved error message": Data abort at 0x0004a998, called by 0x0004a964. I don't know what that means. Under these conditions I guess I can not download any BIN file. I have made a hard reset of the RRC but without results. This happens every one or two days.  Looks like a problem into the RRG, but I don't know. I will thank any hint to solve the situation. Right now I'm down.
Many thanks in advance
73
Antonio, EA4MY

[sm2o]

Hi the webserver is probably overloaded by robots, it's more and more common. Try to upgrade to v2.95 it wil be better to handle that.

73de mike

[EA4MY]

Hi Mike
Many thanks for your suggestion.  I should do that on both ends, I mean, on RRC radio and control, isn't it?
73
Antonio, EA4MY

[EA4MY]

I have v2.84, and I just saw on the web that in my case I have to upgrade both ends.
73

Antonio, EA4MY

[EA4MY]

Hi
I made the upgrade to v2.95 on both ends but this afternoon once again happened the same. I have only a parcial access to web page of the RRC-radio (same as the jpg picture I sent before). This time does not appear any "saved error message". However what I see is that I have communication between both ends as I can switch on and off the TS480 and I receive signals and I can transmit. The problem seems to be with the web server, so I can not switch on and off remotely the Power Supply using the web interface (and, as well, I don't have remote access to the left side menu). I will thank any other hint.
73'
Antonio, EA4MY

[dj0qn]

Antonio

What are you using as the web page's port number? Did you change it from 80 to another number?

73,
Mitch DJ0QN / K7DX

[sm2o]

Changing from port 80 may help temporarily, But we have seen (and heard about) those overload attacks on any port so they scan ports. FW v 2.95 cannot help during the attack but the RRC webserver should not hang up and need a reset after it stops

73 de mike

[EA4MY]

Mitch, I'm using from the very beginning (following your indications years ago) a different port to the 80.
Mike, as I can't reset remotely with the web interface, what I have made every time this happens is a localy hard reset (a local preson on the RRC-radio site swtich off the the RRC' PS), but, as I commented previously, with no results, as the web page doesn't come up, and I have to wait an undefined number of hours until the web page come up again. For instance, right now is up again. I can send the settings .bin file to you  if this can help in any way.
73´
Antonio, EA4MY

[EA4MY]

Mike, as far as I understand from your comments there is nothing we can do to avoid these overload attacks from robots, and how long do the attack last is unknown.  According with this a hard reset does not help because after the reset, the attack is still on and the web server hangs again. Is this what you mean?. If this is the case, this situation should be quite common to many of us. I do not know if many people report this kind of issues.
73
Antonio, EA4MY

[sm2o]

Yes the only way to avoid the attacks is to setup a VPN tunnel to the router, a little bit tricky but 100% bullet proof when it's done. It's not very common but I hear from people now and then which has seen the same happening as you did. Many user do not access there RRC after it's once setup so they do not recognize if it happens as the UDP connections are still working. I hope that v2.95 will be accessible without reset when the attack stops.

73 de mike

[EA4MY]

I understand the VPN tunnel should be setted up between the routers on both ends ?. I'm not an expert in this kind of things. If so, I'll  try to see if I can do something. And, yes, I access to the RRC-radio web site every time I want to make radio because I'm using the output OUT0 on the RRC-radio to switch on-off the TS480 PS, and the PC I'm using at my home on the control side is not premanently connected. In any case I'm intrigued why this started to happen two weeks ago and happens so frecuently (every one or two days). Is it normal attacks to happen so frecuently?.  After all this web server is one more among the hundred of millions in the world...  
73
Antonio, EA4MY

[sm2o]

Yes the robots are scanning all the time and there must be a lot of them . If you put a LINUX based router or rasperryPi on Internet with default passwords is often hacked within days and taken over for sending spam, testing password etc. The RRC is of no interest for them as they can't be used as it's no LINUX but they seems not to bother.

73 demike

[EA4MY]

OK Mike, I see. Just to confirm: the VPN tunnel you suggest to avoid attacks has to be stablished between the routers on both ends radio<->control. Isn't it?.
Many thanks
73
Antonio, EA4MY

[sm2o]

Yes, but as it's the http ports which need to be protected it may be easier to just setup the VPN between the Radio QTH-Router and the PC then use the software client built in to Windows for connecting to the VPN tunnel. That's how I do my self, then I can use Androids VPN-client in the phone, tablet etc also and Im not forced to use a fixed setup.  / 73 de mike

[EA4MY]

OK Mike, you mean instead of a L2L VPN tunnel a client - Server tunnel. Well OK, but I nerver use phone or tablet to make radio. I do radio only from the TS480 detachable front panel at the control QTH. Any way many thanks. I'll see if I can do something with the help of some friend, if not, to withstand the attacks while they last...   or maybe to change the actual web port to see if the attacks are not so often.
73

Antonio, EA4MY