Everyone was complaining about the Internet not working today. First the IP based television, then other devices dropped off of the WiFi network and couldn’t log in.

I looked at the logs and indeed I found some suspicious activity.

Hmm, these lines don’t look right to me. They are all coming in on port 80 and I’m not running any webservers.

So the first thing I did was turn off the port-forwarding to port 80 that was still turned on in my router for some reason. I used it a couple of years ago for an experimental website I was running and didn’t turn the service back off when I was finished. That was dumb!

I searched online to see if there was anything else I should know. This article suggested disabling the UPnP service. Mine was on by default, so I turned that off too.

I’m hoping no real damage was done to the router or my network. I hate the fact that I don’t know precisely why our attempts to login to the router did not work with known-good passwords. But after I reset the password, everyone was able to get logged in again using the new one.

Hopefully my fix will work for a while and we won’t have any more unwelcome visitors.