Blocking router login access from the Internet

Clarifications

http://www.google.com/search?ie=UTF-8&oe=utf-8&q=stop+DOS+attacks

I would guess, however, that these are not intended as DOS attacks, but attempts to gain entry to your network. Keep a strong password, and make sure that incoming traffic on unexpected ports is blocked.

access-list 111 deny tcp any host eq 23
access-list 111 permit ip any any

[i]and, in the WAN interface:[/i]

access-group 111 in

[b]
repeat as necessary for the different protocols you wish to block. If you have the webserver running on the router, make sure to do the same for port 80.[/b]

Side note, failed login attempts have nothing to do with DOS attacks.

Another easy way to protect your logins (assuming a 12.4xxx version IOS):

-- Add an access-class to your vty line

-- The example below allows login via SSH (Secure Shell) to the router from addresses or subnets/wildcards specified in the access-list

EXAMPLE:

!
line vty 0 4
access-class 102 in
authorization exec local_author
login authentication local_authen
transport input ssh
!

-- you can adjust the authorization and login lines to your particular "aaa" setup

-- then add the access-list to match the example "access-class 102 in" as specified in the line vty config section above.

EXAMPLE:

!
access-list 102 remark ---BEGIN ACL 102 VTY---
access-list 102 permit ip 192.168.xxx.0 0.0.0.255 any log
access-list 102 deny ip any any
access-list 102 remark ---END ACL 102 VTY--
!

-- Where "192.168.xxx.0 0.0.0.255" is your local subnet or subnet or ip address authorized to SSH to the router

-- replace the "192.168.xxx.0 0.0.0.255" as necessary for your particular configuration

-- you can also add more "allow ssh login from" addresses by adding them above/before the "deny ip any any" line in the access-list.

EXAMPLE:

!
access-list 102 remark ---BEGIN ACL 102 VTY---
access-list 102 permit ip 192.168.1.0 0.0.0.255 any log
access-list 102 permit ip host 10.10.10.10 any log
access-list 102 deny ip any any
access-list 102 remark ---END ACL 102 VTY--
!

-- you can also change the "any" on the permit lines to a particular ip address of a single interface on your router to further restrict logins. (useful in firewall NAT situations on router with multiple interfaces - you can restrict ssh vty login to the inside interface only)

-- in the following example we will assume that your router has "FastEthernet 0/0" at "192.168.1.1" and "FastEthernet 1/0" at "10.10.10.1" and we want to restrict logins to a single host at ip address "10.10.10.10" on the "FastEthernet 1/0" connected subnet and only to the "FastEthernet 1/0" interface, as opposed to all (any) of the interfaces on the router.

EXAMPLE:

!
access-list 102 remark ---BEGIN ACL 102 VTY---
access-list 102 permit ip host 10.10.10.10 host 10.10.10.1 log
access-list 102 deny ip any any
access-list 102 remark ---END ACL 102 VTY--
!

-- you should also consider including the following lines in your config to further harden the login process and thwart brute-force attacks.

EXAMPLE:

!
login block-for 180 attempts 5 within 60
login on-failure log
login on-success log
!
ip ssh time-out 60
ip ssh authentication-retries 2
!

-- hope that helps you out