I got an "Internet abuse message" letter when running PI-Hole (user pi):
Oct 16 14:20:18 bc sshd[16379]: Invalid user pi from 83.128.185.07 port 34120
Oct 16 14:20:18 bc sshd[16380]: Invalid user pi from 83.128.185.07 port 34122
Oct 16 14:20:18 bc sshd[16379]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.128.185.07
Oct 16 14:20:18 bc sshd[16380]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.128.185.07
Oct 16 14:20:20 bc sshd[16379]: Failed password for invalid user pi from 83.128.185.07 port 34120 ssh2
Oct 16 14:20:20 bc sshd[16379]: Connection closed by 83.128.185.07 port 34120 [preauth]
Oct 16 14:20:20 bc sshd[16380]: Failed password for invalid user pi from 83.128.185.07 port 34122 ssh2
Oct 16 14:20:20 bc sshd[16380]: Connection closed by 83.128.185.07 port 34122 [preauth]
What was the nature of your "Internet abuse message" letter?
From your log snippet there it looks like someone is trying to log into your Raspberry pi over SSH. I'm guessing it's probably not a much of a stretch to assume you also have port 53 forwarded to your pi, too, for DNS.
If that is the case you're running an open resolver and there are many reasons as to why you really shouldn't be doing that (even people that know what they're doing tend not to). I'm not going to go into details here as there are many posts on this very forum, as well as accross the internet, explaining why it's a bad idea.
Was the letter from your ISP? ISPs, especially for non-business ones, tend to frown on that type of activity.
Hi No, I havent't a port forward in the router (Linksys E3200), and it is not connected to a DMZ.
This router doesn't seem to have a mechanism to block traffic on certain ports, as far I can see.
Is it possible to block this traffic in the router?
Use Shields Up! from GRC to test what ports you have open. If they are not all green, you have some fixing to do (assuming you are not running something you actually want anyone to access).
I made an error in my firewall setup and had Port 53 open.
