Illegal Login keeps happening
- Thread starter Rockjaw
- Start date
Factory reset your router and NVR.
But depending on the age of the NVR, if it is hacked via serial number, it will be found again.
You may need to block it at the router level and then use a VPN.
But depending on the age of the NVR, if it is hacked via serial number, it will be found again.
You may need to block it at the router level and then use a VPN.
Turn off Port Forwarding on your router.
This will prevent you from accessing your system when out and about. Set-up a VPN on your router to allow a more secure means to access your system moving forward
This will prevent you from accessing your system when out and about. Set-up a VPN on your router to allow a more secure means to access your system moving forward
alastairstevenson
Staff member
It may still be active.
Check if UPnP is enabled on the router, and also on the (unknown) device. If enabled, this would allow the device to configure port forwarding all by itself.
To find out what inbound access is available from the internet, a very good tool is ShieldsUp! : (use the standard ports option edit All Service ports)
GRC | ShieldsUP! — Internet Vulnerability Profiling
GRC Internet Security Detection System
Note that typically, on Dahua gear, Illegal Login in the log means they "tried and failed", and based on the number of attempts set on the device, were blocked for some time duration (also a setting)
Willing to bet you are still port forwarding or UPnP is enabled @alastairstevenson mentioned.
While I dont think its happening, IF you have older FW on the NVR pre-Aug 2024, there is a potential security issue with P2P if you are using it, and you should update fw
Willing to bet you are still port forwarding or UPnP is enabled @alastairstevenson mentioned.
While I dont think its happening, IF you have older FW on the NVR pre-Aug 2024, there is a potential security issue with P2P if you are using it, and you should update fw
Last edited:
Thank you @wittaj @SpacemanSpiff @alastairstevenson @bigredfish for all of your comments and helping me, really appreciate it. I will factory default my router in the next week or so, I need everything up and running for work so it's a bit tricky to take it down incase I have issues setting it back up. Just wanted to let you know for the time being I have just unplugged the NVR off of my network so no one can access it.
Port Forwarding is already off on the router as I looked into that last time but this time I will also check UPnP and see if I can find that setting. I have an ASUS AX11000 Rog router and maybe there's a VPN setting in there I am able to use? if anyone knows where and how I can setup a VPN for the NVR.
Device Model: NVR8CH-8P-2AI
It looks like my Firmware is 4.005.0000000.1.R and Build Date 2024-07-16 (so I think I need to update the firmware). I'll have to do some searching online and see if I can find the newest updated version
Port Forwarding is already off on the router as I looked into that last time but this time I will also check UPnP and see if I can find that setting. I have an ASUS AX11000 Rog router and maybe there's a VPN setting in there I am able to use? if anyone knows where and how I can setup a VPN for the NVR.
Device Model: NVR8CH-8P-2AI
It looks like my Firmware is 4.005.0000000.1.R and Build Date 2024-07-16 (so I think I need to update the firmware). I'll have to do some searching online and see if I can find the newest updated version
alastairstevenson
Staff member
Suggestion : Before you do that - check with ShieldsUp!
It's easy peasy to use, and will tell you quickly and clearly what ports if any are open to access from the internet.
The 'All Service Ports' option is probably the best to use.
GRC | ShieldsUP! — Internet Vulnerability Profiling
GRC Internet Security Detection System
alastairstevenson
Staff member
Ah, but, I just thought, if you've now disconnected the NVR from internet access, no connection from the internet will happen, even if port forwarding is active.
The NVR has been disconnected from the network but shields up should still test the router? This was the scan that I just did (The image isn't loading) but this is what the site said.
THE EQUIPMENT AT THE TARGET IP ADDRESS
DID NOT RESPOND TO OUR UPnP PROBES!
(That's good news!)
I also just upgraded to the newest Firmware Jan 21st 2025 on my NVR. I will do my Router tonight and then look to see if I can setup a VPN as well.
alastairstevenson
Staff member
No, it's the NVR that's the inbound target if the router is allowing the traffic through.
And you've stated that the NVR has been disconnected, therefore ShieldsUp! won't be able to see it, even if the router lets the probes through.
That's not the suggested test.
What's suggested is the 'All Service Ports' test. When the NVR is connected.