AT&T is intercepting SSH traffic

[dherr]

I am on FTTN X1 with the 5031NV-030, not the same as yours. I have found that it is best to do a factory reset as the first step when changing anything on the router. Otherwise things don't tend to work as well.

I know you did not initiate this change but it might be time to try a fresh config.

[ckuethe]

Waving the useless dead chicken (factory resetting) didn't help. Of course it wouldn't, because AT&T change the configuration and resetting the modem's configuration would cause it to just reapply their broken configuration.

[qu1ck]

Can confirm, have the same issue as well. My lastb log shows that scanner attacks stopped Fri Jul 7 09:10.
I noticed it only today, when I tried to ssh to my home from work and got a MITM warning.

[dherr]

I was going to ignore this thread due to the "useless dead chicken" remark from ckuethe, but with somebody else seeing the same behavior I can't resist...

Has anybody checked to confirm that this is only intercepting port 22, or if it really is blocking all ssh traffic?

I assume it is only blocking port 22.

I verified that my 5031NV-030 is still letting me ssh in via the two alternate ports that I am using for inbound ssh. I also confirmed that it is still not listening on port 22.

I use alternate ports partly due to having two hosts that I want to be able to ssh to and partly due to the lessening of the password guessing traffic.

[sonic guest]

That's interesting. I run on a nonstandard port and I don't see it happening with my FTTN X1 connection. Port 22 is also closed on the WAN interface. I'm using a 5031nv.

[qu1ck]

No, it only happens on port 22. I opened alternative port for sshd and am able to connect as usual.

[qu1ck]

Another data point:
https://www.reddit.com/r/uverse/comment ... _redirect/

Btw I also have NVG599 modem.