Questions about chasing hackers.

The situation is that I'm losing satellite ISP data allowance and I assume it generates from hackers. I operate a small wired local area network with 5 workstations, a printer and a NAS. The satellite modem is connected directly to a SonicWALL firewall router. Connected to the router are two workstations, the NAS and a switch which leads to the remaining network nodes. The SonicWALL should stop the intrusions but apparently it doesn't. I have the Norton firewall running on the workstations.

There appear to be no viruses on any of the Windows workstations. I have run ESET, Norton, Norton NPE and nothing is uncovered. There appear to be no harmful processes running in Windows based on process explorer scans. I can run a Netstat on any workstation at any time and find ports with IP's with established connections that are untraceable. I assume those are the hackers. There is no point in blocking IP's because the IP's change all time. They are probably operated through VPN services.

I'm at wit's end. If there is anybody out there that understands what I'm talking about and has a suggestion on the next step I might take, please respond. Thanks.

Apparently the hackers are getting past the firewall. I've started putting deny rules individually for the IP's of each intrusion and that seems to be chasing them away, at least for now. It is an ugly world out there. My advice to people considering a SonicWALL purchase is to be sure the unit you have has the ability to deny entire countries. Mine doesn't and I would have bought an upgraded model if I had known.

You didn't mention it, but, does the upgraded model have the better encryption: WPA2?

I'm about to jump into the deep end in setting up a network with an Internet Provider router. I'm hoping for the best.

Added: the struggle is to open enough portals to access the internet, but not so many as to allow those on the internet to access the network's resources.

fmw said:

Apparently the hackers are getting past the firewall. I've started putting deny rules individually for the IP's of each intrusion and that seems to be chasing them away, at least for now. It is an ugly world out there. My advice to people considering a SonicWALL purchase is to be sure the unit you have has the ability to deny entire countries. Mine doesn't and I would have bought an upgraded model if I had known.

Click to expand...

You should have the ability to ban a range?

like:

192.*.*.*

Might this work? They surely are not changing providers or countries.