Syntax42
I am using Endian Firewall Community which has OpenVPN built in. I recently noticed my log partition had filled up 20 GB in less than a day. Today, I got a chance to read the log file before it got too big to transfer off the firewall. Between noon and 3PM, the log file had grown to about 2.5 GB. I had no active VPN connections at that time, but I noticed the logging started at the same time I locked my computer and went to lunch. That's when I suspected a client issue with my computer, which is on a separate network from the firewall.
The logs repeated the following lines. I don't know where the pattern begins, so I just picked a line.
May 10 11:55:53 testlab openvpn[4978]: Re-using SSL/TLS context
May 10 11:55:53 testlab openvpn[4978]: LZO compression initialized
May 10 11:55:53 testlab openvpn[4978]: TCP connection established with xxx.xxx.xxx.xxx:64543
May 10 11:55:53 testlab openvpn[4978]: TCPv4_SERVER link local: [undef]
May 10 11:55:53 testlab openvpn[4978]: TCPv4_SERVER link remote: xxx.xxx.xxx.xxx:64543
May 10 11:55:53 testlab openvpn[4978]: xxx.xxx.xxx.xxx:64543 Non-OpenVPN client protocol detected
IPs were intentionally removed. They were my external IP address.
Every iteration of those lines resulted in the port number increasing by one. I definitely wasn't running something to scan my own ports, which is why this was so strange.
The issue ended up being another VPN client I left running (but inactive) in the background called Mx Tunnel. It is supposed to go with a server called BarracudaDrive. After I closed it in task manager, the log file immediately stopped growing.
I hope someone else who has the same issue will be able to find this thread and fix their issue faster. In the meantime, is there a config file for OpenVPN that I can change to reduce the verbosity of logging so it doesn't do this again?
