user guest 82.154.164.36

[armeniomanuel]

Hello. last week i had some problems because there was a user or users i dont know why that was filling my 12 users licence lines instead of the users of my domain that are always from the range 10.81.8.111 my proxy that wasted gigabytes of my traffic (in portugal we only have 4 gb international...shame..).
I really dont know where this users come from...i trace them to several countries...china, japan, framce, etc.
What i do is to disable user guest but now with this ip.82.154.164.36 its trying to enter every 2 minutes.
Question: does this affect perfomance...always trying to enter?
Can i block this specific range of ips or just ONLY alow ips 10.81.8.etc?
this 82...ip i think is portugal ip...is it caused by the router? a thompson 510 router?

thanks very much.

[genie]

Make sure your proxy is not bound on external adapter - effectively making your proxy available for outside connection.

[greboriorobert]

Use Whois (from Internic or other) for find origin intrusion

Robert

[deftech]

Does it affect performance? Sure. Will it be noticeable? Probably not.

Do what genie said, and you could also blackhole that ip. Won't blackholing it effectively make Wingate drop packets coming from that source?

[armeniomanuel]

Thanks 4 your help everybody. those ip.s come from everywere and i.m not so good with wingate so i did this: my ip range is 10.81.8.1 and i put all ip.s in my domain as assumed users to all people and then i disableded the user "guest". I also shut down the proxy everyday after work and at weekends. Last weekend those ip.s from outside drain us 4 gb of international traffic...(we in portugal only have 4 gb and then we PAY 1 dollar for 100 mb extra :(
I dont know the place in wingate were i disable this outside conection but im also sending and attacment to Pascal vam buren email.
thanks :)

[genie]

If you open Properties page for your WWW proxy, there is a page their called Bindings - make sure you do not have "Bind on all external adapters" line on the list.

[armeniomanuel]

thanks. i will see that...but i will send you (genie) a print of the bindings ok?
p.s. today i just bought qbik the "pure sight" plugin..im going to install it...it doesnt interfeer with this problem no??
thanks

[Pascal]

What you've got is a binding on all internal adapters. Your "public" adapter should be marked as "External". Do this on the Network Pane by double clicking and setting it manually to external.