Modem creating port forward rules by itself and if i delete it it comes back

[nothing1]

so as the tittle says i have a sagecom f@st modem(Optus) that has two entries in NAT -- Virtual Servers Setup the port forwarding part of the modem that are called "Garfield" one has port 1671 UDP the other is port 1547 UDP. i can delete these entries and they will stay gone for 5-25 minutes but the the will return but using different ports, also i have my pc set as a static ip and the entries are for different device ip's my Internet provider say they knows nothing about this but no one else would have access to my modem as it is not default password/username and it is a hidden network. Any information as to what is going on would be most appreciated>

[DLord]

13 minutes ago, nothing1 said:

so as the tittle says i have a sagecom f@st modem(Optus) that has two entries in NAT -- Virtual Servers Setup the port forwarding part of the modem that are called "Garfield" one has port 1671 UDP the other is port 1547 UDP. i can delete these entries and they will stay gone for 5-25 minutes but the the will return but using different ports, also i have my pc set as a static ip and the entries are for different device ip's my Internet provider say they knows nothing about this but no one else would have access to my modem as it is not default password/username and it is a hidden network. Any information as to what is going on would be most appreciated>

Any chance that you have a game called "Garfield Kart: Furious Racing" (or something like that) installed on your PC/Game Console?

[Dodel]

28 minutes ago, nothing1 said:

so as the tittle says i have a sagecom f@st modem(Optus) that has two entries in NAT -- Virtual Servers Setup the port forwarding part of the modem that are called "Garfield" one has port 1671 UDP the other is port 1547 UDP. i can delete these entries and they will stay gone for 5-25 minutes but the the will return but using different ports, also i have my pc set as a static ip and the entries are for different device ip's my Internet provider say they knows nothing about this but no one else would have access to my modem as it is not default password/username and it is a hidden network. Any information as to what is going on would be most appreciated>

 

Install Wireshark, do some packet sniffing, see where the end route is.

 

Edit : un-needed quote.

 

 

 

 

[jbleck]

You need to know who creates the "Garfield" rules... most likely an app u have installed.

Block the "Garfield" app with your device OS firewall and then delete them rules in your modem ... The sneaky Garfield shouldn't be able to reach the modem then.

Use that modem feature to your advantage.

[nothing1]

1 hour ago, DLord said:

Any chance that you have a game called "Garfield Kart: Furious Racing" (or something like that) installed on your PC/Game Console?

No

 

1 hour ago, Dodel said:

 

Install Wireshark, do some packet sniffing, see where the end route is.

 

Edit : un-needed quote.

 

 

 

 

not sure on how to do that

 

35 minutes ago, jbleck said:

You need to know who creates the "Garfield" rules... most likely an app u have installed.

Block the "Garfield" app with your device OS firewall and then delete them rules in your modem ... The sneaky Garfield shouldn't be able to reach the modem then.

Use that modem feature to your advantage.

the rules created are not for my device the Garfield ip's matches iphone ip's that are in our house my wife and daughters iphone ip's match the Garfield entries. What concerns me is i did not think that an app could do this that easily otherwise utorrent and other torrent programs would not be so "difficult" to configure as they would just open the required ports themselves?? Is there any way of using my os's firewall ESET to block this thing and if so how?

[Dodel]

1 hour ago, nothing1 said:

No

 

not sure on how to do that

 

the rules created are not for my device the Garfield ip's matches iphone ip's that are in our house my wife and daughters iphone ip's match the Garfield entries. What concerns me is i did not think that an app could do this that easily otherwise utorrent and other torrent programs would not be so "difficult" to configure as they would just open the required ports themselves?? Is there any way of using my os's firewall ESET to block this thing and if so how?

 

Nothing should be able to apply any rule automatically, specifically at NAT level.

 

Grab TCPMonitor, does it show what IP Garfield is resolving too, also within TCPMonitor, you can blacklist the app / port (you need to keep TCPMonitor running), but at least you can see if it has any adverse effects, if after that there are no issues, type Windows firewall in the start menu, open it up and select advanced settings, then click new rule, should be easy enough to follow.

 

[nothing1]

9 hours ago, Dodel said:

 

Nothing should be able to apply any rule automatically, specifically at NAT level.

 

Grab TCPMonitor, does it show what IP Garfield is resolving too, also within TCPMonitor, you can blacklist the app / port (you need to keep TCPMonitor running), but at least you can see if it has any adverse effects, if after that there are no issues, type Windows firewall in the start menu, open it up and select advanced settings, then click new rule, should be easy enough to follow.

 

do i install this on my pc or the Iphones?

 

note, i think i may have figured out the problem i have a cleverdog security wireless camera at home, when i went to view it last night the app on my Iphone said that it couldn't connect then about 20 seconds later it connected, at the time i thought that it was strange that it did not connect as it had always connected straight away before, then i remembered that i had not used that app since deleting the "Garfield" rules in the router and wondered if my phones IP would now have a rule in the router and when i checked it did. i am still concerned that something can just create a rule in the firewall like this is this normal behavior. Obviously i had to set the camera up when i got it so maybe this has some how given it the ability to create the rules. I will disconnect the camera and re-delete the rules in the router and if they do not come back then that is the culprit.Thanks to everyone that responded, once again i thought that making a rule like this would have to be done manually as like i said before Utorrent and similar programs could use the same process to make things a lot easier???

[nothing1]

IT is the wifi camara FFS