@varx @nightpool@cybre.space uh huh and how do you proprose i fix it
@nightpool @squirrel
I think... OK, so to produce this effect, the router would have to be terminating the inbound TCP connection itself, and then opening a new TCP connection to your server.
So my next step would be seeing if this happens for other protocols/ports. I guess open another port, send in an HTTP request, and try a packet capture to see what the remote IP is? 🤷
@squirrel @nightpool Man, I wish I knew. :-( I'm fighting with some Router Weirdness myself, and don't have openwrt experience.
What I was trying to say, and I guess I flubbed it, was: I agree that that VPS experiment does seem to rule out malware as the obvious explanation. (Also, can now confirm that my sshd does not do this.)