hi,
I have a OpenVPN server running. It has a public IP address and I use tls-auth. I just found out that my server is getting flooded with the following requests:
XXX.XXX.XXX.XXX:XXXXX SIGUSR1[soft,tls-error] received, client-instance restarting
XXX.XXX.XXX.XXX:XXXXX TLS: Initial packet from [AF_INET]XXX.XXX.XXX.XXX:XXXXX, sid=a0d85520 f3fd1603
XXX.XXX.XXX.XXX:XXXXX TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
XXX.XXX.XXX.XXX:XXXXX TLS Error: TLS handshake failed
This is my server config:
dev tun0
proto udp
port XXXX
ca ca.crt
cert server.crt
key server.key
tls-auth ta.key 0
dh dh2048.pem
cipher AES-256-CBC
user nobody
group nogroup
server X.X.X.X 255.255.255.0
route X.X.X.X 255.255.255.0
push "explicit-exit-notify 3"
client-config-dir ccd
persist-key
persist-tun
status /var/log/openvpn-status.log
management 127.0.0.1 81
keepalive 10 120
verb 3
log /var/log/openvpn.log
comp-lzo
Is somebody attacking me? Can I detect or prevent such attacks??
Thanks
Hansemann
