OVPN Server TCP connection established from same IP address

[Chuckles67]

Asus AX-86U running Merlin. System Log shows this roughly every two hours. I don't know who this is.

Jun 14 16:16:49 ovpn-server2[2371]: TCP connection established with [AF_INET]204.76.203.208:36116
Jun 14 16:16:49 ovpn-server2[2371]: 204.76.203.208:36116 TCP connection established with [AF_INET]204.76.203.208:33586
Jun 14 16:16:49 ovpn-server2[2371]: 204.76.203.208:33586 WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1768 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Jun 14 16:16:49 ovpn-server2[2371]: 204.76.203.208:33586 Connection reset, restarting [0]
Jun 14 16:16:49 ovpn-server2[2371]: 204.76.203.208:33586 SIGUSR1[soft,connection-reset] received, client-instance restarting
Jun 14 16:16:49 ovpn-server2[2371]: 204.76.203.208:36116 Connection reset, restarting [0]
Jun 14 16:16:49 ovpn-server2[2371]: 204.76.203.208:36116 SIGUSR1[soft,connection-reset] received, client-instance restarting

I tried adding this ip address to the Firewall - URL Filter List but does not block these connections from that ip address.

Any suggestions how to block a known ip address that repeatedly tries to establish a connection?

 

[ColinTaylor]

Normal port scanning from the internet. Nothing unusual there. https://www.abuseipdb.com/check/204.76.203.208

The URL Filter filters URLs.

Change your OpenVPN server's listening port to something random and non-obvious, e.g. 14138.