Router rebooted when someone tried VPN

[Pergola Fabio]

running 384.9 , this night my router rebooted
seems someone tried to make ovpn, yes, thats possible, it failed, thank god, but why did a reboot start?

these are latest logs :
Apr 12 22:55:24 ovpn-server1[1721]: 185.200.118.69:55935 TLS: Initial packet from [AF_INET]185.200.118.69:55935, sid=12121212 12121212
Apr 12 22:56:24 ovpn-server1[1721]: 185.200.118.69:55935 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Apr 12 22:56:24 ovpn-server1[1721]: 185.200.118.69:55935 TLS Error: TLS handshake failed
Apr 12 22:56:24 ovpn-server1[1721]: 185.200.118.69:55935 SIGUSR1[soft,tls-error] received, client-instance restarting
May 5 07:05:05 syslogd started: BusyBox v1.25.1

 

[L&LD]

running 384.9 , this night my router rebooted
seems someone tried to make ovpn, yes, thats possible, it failed, thank god, but why did a reboot start?

these are latest logs :
Apr 12 22:55:24 ovpn-server1[1721]: 185.200.118.69:55935 TLS: Initial packet from [AF_INET]185.200.118.69:55935, sid=12121212 12121212
Apr 12 22:56:24 ovpn-server1[1721]: 185.200.118.69:55935 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Apr 12 22:56:24 ovpn-server1[1721]: 185.200.118.69:55935 TLS Error: TLS handshake failed
Apr 12 22:56:24 ovpn-server1[1721]: 185.200.118.69:55935 SIGUSR1[soft,tls-error] received, client-instance restarting
May 5 07:05:05 syslogd started: BusyBox v1.25.1

Is that maybe the method that was used to try to 'break' your router into letting them in?

 

[Pergola Fabio]

? i dont understand?

 

[thelonelycoder]

Apr 12 22:56:24 ovpn-server1[1721]: 185.200.118.69:55935 SIGUSR1[soft,tls-error] received, client-instance restarting

Not sure, but the SIGUSR1 is a signal to restart the service. This may have been invoked by ovpn-server1 itself, not through a maligned attack signal by the IP.
I hope it's not possible to do the latter.

 

[Pergola Fabio]

hmm, but i have no idea what that IP address is?
https://whatismyipaddress.com/ip/185.200.118.69

 

[octopus]

hmm, but i have no idea what that IP address is?
https://whatismyipaddress.com/ip/185.200.118.69

That ip is from well known attacker and should be blocked.

 

[Pergola Fabio]

@octopus how do you know that? and even worse? how was he able to reboot my roouter by initiating an vpn session?

 

[bbunge]

My routers were continually getting connection attempts via openvpn until I changed the default port.

Sent from my SM-T380 using Tapatalk

 

[Pergola Fabio]

thats indeed something i can do
but then still, how can he reboot my router by initiating a connection ?

 

[dave14305]

Could be the early stages of an exploit by fuzzing. It probably crashed the router, not rebooted it.

 

[ColinTaylor]

but then still, how can he reboot my router by initiating a connection ?

It may just be a coincidence, those are standard messages when a client can't connect. So expect to see them all the time unless you change the port number.

He can't reboot your router, although it's quite possible there's a bug in the OpenVPN code that is crashing your router. You need to check the time after the router came back up to determine exactly when it happened. If there's more than a couple of minutes difference then it's probably caused by something else.

 

[QuikSilver]

@octopus how do you know that? and even worse? how was he able to reboot my roouter by initiating an vpn session?

https://otx.alienvault.com/indicator/ip/185.200.118.69

@Pergola Fabio Any chance you have Skynet installed? If not I'd recommend adding that script. It would help show you possible attacks to your router and block them if you choose.

 

[Pergola Fabio]

No , no skynet... Indeed didnt check the time it came up, could be indeed time between...

Anyway, gonna change the port also

 

[eibgrad]

Yeah, I agree, don't use the well-known port for OpenVPN (1194), or the well-known port for *any* services if you can help it. Heck, I've gotten so paranoid over the past couple years, I keep *every* public facing service disabled until I know for sure I will need it remotely. And even then, I only start the SSH server (w/ PKI only), then start other services (e.g., OpenVPN server) from there. And when I'm done, I shut it down. I just don't trust keeping services exposed anymore unless absolutely necessary.

 

[dave14305]

No , no skynet... Indeed didnt check the time it came up, could be indeed time between...

Anyway, gonna change the port also

What was the time in syslog after NTP synced? I would just run this to find it:

grep disparity /tmp/syslog.log

 

[Pergola Fabio]

crap, seems syslog is limited , cant go back anymore to the 12/04