Router logs showed outside access to a NAS SSH port
The internet suddenly stopped working even though the cable connection still appeared healthy. and , which handled local DNS, were also operating normally. Shortly before the outage, the UGREEN NAS made several unusual STUN requests.
Restarting the router restored internet access, but its logs showed WAN and remote-access activity from unfamiliar outside . Most seriously, the logs recorded to port 22 on the NAS's local address. Port 22 is commonly used for SSH .
The available details do not prove that an intrusion occurred or that UPnP opened the port.
Key points
- The cable connection and local DNS services appeared healthy during the outage.
- The UGREEN NAS made several unusual STUN requests.
- The router recorded remote activity from unfamiliar outside .
- to the NAS's SSH port 22 appeared in the router logs.
- The available details do not confirm an intrusion or prove that UPnP caused the exposure.