AC86U with 384.5 VPN log question

[JAF]

Quick question,

I'm using my 86U as an OpenVPN server so we can connect to it anytime we're on another WiFi. It's working great for all our devices. Looking thought the logs today, I'm noticing this entry a few times a day. It's at times I know no one is trying to connect to the VPN. Is this someone else trying to connect to my VPN server unsuccessfully? What do these log entries mean? Thanks!

Jun 24 16:47:26 ovpn-server1[2007]: 185.200.118.88:37919 TLS: Initial packet from [AF_INET]185.200.118.88:37919, sid=12121212 12121212

Jun 24 16:48:26 ovpn-server1[2007]: 185.200.118.88:37919 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

Jun 24 16:48:26 ovpn-server1[2007]: 185.200.118.88:37919 TLS Error: TLS handshake failed

Jun 24 16:48:26 ovpn-server1[2007]: 185.200.118.88:37919 SIGUSR1[soft,tls-error] received, client-instance restarting

 

[ColinTaylor]

That's just the normal probing/hacking attempts that you get when you expose router services to the internet.

https://www.snbforums.com/threads/ac3100-380-70-block-incoming-ip.47001/

 

[JAF]

Thanks for confirming! That's the only service that is exposed and I'd like to keep it running instead of turning it off and on.

 

[ColinTaylor]

Simply changing the default port from 1194 to something non-standard will greatly reduce the number of attempts.

 

[PolarBear]

Quick question,

I'm using my 86U as an OpenVPN server so we can connect to it anytime we're on another WiFi. It's working great for all our devices. Looking thought the logs today, I'm noticing this entry a few times a day. It's at times I know no one is trying to connect to the VPN. Is this someone else trying to connect to my VPN server unsuccessfully? What do these log entries mean? Thanks!

Jun 24 16:47:26 ovpn-server1[2007]: 185.200.118.88:37919 TLS: Initial packet from [AF_INET]185.200.118.88:37919, sid=12121212 12121212

Jun 24 16:48:26 ovpn-server1[2007]: 185.200.118.88:37919 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

Jun 24 16:48:26 ovpn-server1[2007]: 185.200.118.88:37919 TLS Error: TLS handshake failed

Jun 24 16:48:26 ovpn-server1[2007]: 185.200.118.88:37919 SIGUSR1[soft,tls-error] received, client-instance restarting

I have almost identical entries in the system log, starting since April this year.

By coincidence, I did an analysis this afternoon and found that 80% of log in attempts are coming from servers in the same range, 185.200.118.0/24.

What puzzles me is that the log file entry is written by OpenVPN server, which on my router is listening on a non-standard port.

What I am trying to understand, is if this means that someone has correctly guessed the port, and has simply failed to log in because they did not have the correct (non-standard) user id and password?

Surely if the log in attempt was received on a different port, OpenVPN would not even see the attempt, and so would not write anything to the log file?

 

[ColinTaylor]

@PolarBear Double-check both OpenVPN servers. Perhaps you coincidentally moved it to another "standard" port.

This post shows the ports and protocols that subnet is probing.

 

[PolarBear]

@PolarBearPerhaps you coincidentally moved it to another "standard" port.

Thank you, that was most helpful. It turns out I was completely mistaken and have been using the standard port all along.

That explains why OpenVPN saw the port knocking and logged it to the system log.

Obviously, changing to a non-standard port would make things more difficult for someone trying to break in.

But if I do this, is it more likely that when I am travelling, the hotel's network will block my VPN connection ?

 

[ColinTaylor]

But if I do this, is it more likely that when I am travelling, the hotel's network will block my VPN connection ?

I'm sure there are more seasoned travellers than me on these forums that can give better feedback. But in my limited experience I have found most places either allow everything or only HTTP/HTTPS. There's probably very few places that explicitly block port 1194.

I suppose if you did change your VPN to a non-standard port and then got stuck somewhere that blocked it you could use a mobile phone data connection to connect through the VPN, log into the router and change the port. Or, already have the second OpenVPN server configured for TPC/443 but not enabled. Then use your mobile login to turn it on.

 

[JAF]

Simply changing the default port from 1194 to something non-standard will greatly reduce the number of attempts.

Done! Great idea, thanks again.