这个是怎么回事？是在被人暴力破解吗？关键是，源地址就是openwrt的地址。看不懂

project_box

Tue Sep 19 16:06:28 2023 authpriv.info dropbear[29416]: Child connection from 192.168.102.1:40028
Tue Sep 19 16:06:30 2023 authpriv.warn dropbear[29416]: Bad password attempt for 'root' from 192.168.102.1:40028
Tue Sep 19 16:06:30 2023 authpriv.info dropbear[29416]: Exit before auth from <192.168.102.1:40028>: (user 'root', 1 fails): Exited normally
Tue Sep 19 16:06:39 2023 authpriv.info dropbear[29417]: Child connection from 192.168.102.1:59346
Tue Sep 19 16:06:41 2023 authpriv.warn dropbear[29417]: Bad password attempt for 'root' from 192.168.102.1:59346
Tue Sep 19 16:06:41 2023 authpriv.info dropbear[29417]: Exit before auth from <192.168.102.1:59346>: (user 'root', 1 fails): Exited normally
Tue Sep 19 16:06:51 2023 authpriv.info dropbear[29418]: Child connection from 192.168.102.1:46682
Tue Sep 19 16:06:53 2023 authpriv.warn dropbear[29418]: Bad password attempt for 'root' from 192.168.102.1:46682
Tue Sep 19 16:06:54 2023 authpriv.info dropbear[29418]: Exit before auth from <192.168.102.1:46682>: (user 'root', 1 fails): Exited normally
Tue Sep 19 16:07:03 2023 authpriv.info dropbear[29419]: Child connection from 192.168.102.1:40654
Tue Sep 19 16:07:05 2023 authpriv.warn dropbear[29419]: Bad password attempt for 'root' from 192.168.102.1:40654
Tue Sep 19 16:07:06 2023 authpriv.info dropbear[29419]: Exit before auth from <192.168.102.1:40654>: (user 'root', 1 fails): Exited normally
Tue Sep 19 16:07:22 2023 authpriv.info dropbear[29420]: Child connection from 192.168.102.1:49662
Tue Sep 19 16:07:24 2023 authpriv.warn dropbear[29420]: Bad password attempt for 'root' from 192.168.102.1:49662
Tue Sep 19 16:07:24 2023 authpriv.info dropbear[29420]: Exit before auth from <192.168.102.1:49662>: (user 'root', 1 fails): Exited normally
Tue Sep 19 16:07:33 2023 authpriv.info dropbear[29422]: Child connection from 192.168.102.1:34754
Tue Sep 19 16:07:35 2023 authpriv.warn dropbear[29422]: Bad password attempt for 'root' from 192.168.102.1:34754
Tue Sep 19 16:07:35 2023 authpriv.info dropbear[29422]: Exit before auth from <192.168.102.1:34754>: (user 'root', 1 fails): Exited normally
Tue Sep 19 16:07:44 2023 authpriv.info dropbear[29423]: Child connection from 192.168.102.1:40416
Tue Sep 19 16:07:46 2023 authpriv.warn dropbear[29423]: Bad password attempt for 'root' from 192.168.102.1:40416

yuan6975

你这个192.168.102.1 是内网？  外网我没见到过192.168开头的  你看看内网里面有没有这个设备

project_box

yuan6975 发表于 2023-9-24 10:42
你这个192.168.102.1 是内网？  外网我没见到过192.168开头的  你看看内网里面有没有这个设备 ...

确实是外网攻击我
是这样的，这台路由器（记为A）没有公网的地址。为了能达到能远程访问的目的，这个路由器上打了一个ssh隧道到老家的路由器上（记为B，有公网地址），配了ssh远端端口转发。攻击方其实攻击的是B的地址，远端转发到A上面来的，从A来看就是从192.168.102.1来的攻击