VPN server logs

[Logi]

I have the following logs on my VPN server on the RT-AC5300, what is the meaning of them? I wasn't trying to connect to:

Jul 13 20:11:32 15[IKE] 216.218.206.102 is initiating a Main Mode IKE_SA
Jul 14 02:37:53 10[IKE] 71.6.158.166 is initiating a Aggressive Mode IKE_SA
Jul 14 06:11:01 05[IKE] 89.248.167.131 is initiating a Aggressive Mode IKE_SA
Jul 14 21:46:15 11[IKE] 71.6.146.186 is initiating a Aggressive Mode IKE_SA
Jul 14 22:04:22 13[IKE] 216.218.206.90 is initiating a Main Mode IKE_SA
Jul 15 21:05:11 14[IKE] 216.218.206.82 is initiating a Main Mode IKE_SA

 

[kfp]

You are getting “door knocks” from the Internet. You’ll see less of those if you use a non-standard port ie. move away from UDP port 1194.

 

[Logi]

You are getting “door knocks” from the Internet. You’ll see less of those if you use a non-standard port ie. move away from UDP port 1194.

I am using Apple devices (iOS, macOS) to connect to the router configured with IPSEC, I did not find the place where I can customize the port on the client side? Please could you provide some guidance, thanks

 

[ColinTaylor]

It's port scanning.

At least the 216.218.206.* addresses tell what they're doing (which is a first).

The Shadowserver Foundation


If you are looking at this page, then more than likely, you noticed a scan coming from this server across your network and/or poking at a service that you have running.

The Shadowserver Foundation is currently undertaking a project to search for publicly accessible devices that have services running that should not be exposed because they are trivial to exploit or abuse. The goal of this project is to identify hosts that have these types of services exposed andreport them back to the network owners for remediation.

Further details on this scanning project can be found on our blog at: http://blog.shadowserver.org/2014/03/28/the-scannings-will-continue-until-the-internet-improves/

Statistics on these scans can be found at: http://blog.shadowserver.org/2014/08/22/of-scannings-and-statistics/

If you would like to sign up for reports on any data that we have collected on your network, you can request them from here: https://www.shadowserver.org/wiki/pmwiki.php/Involve/GetReportsOnYourNetwork

All of the probes that are used in our tests are benign and do not ( and will never ) contain exploit code. Scans with these types of tools are off-limits for us.

All the data that we collect is visible to anyone who connects to a particular host with on the proper port using the proper commands.

If you have any more questions please feel free to send us an email at: gro [tod] revreswodahs [ta] nacssnd



The Shadowserver Foundation

 

[kfp]

I am using Apple devices (iOS, macOS) to connect to the router configured with IPSEC, I did not find the place where I can customize the port on the client side? Please could you provide some guidance, thanks

Ah, I assumed it was OpenVPN, my bad.

 

[ColinTaylor]

Also, this is probably more specific to this case:

https://isakmpscan.shadowserver.org/