hsinanch
Hi,
Anyone has successsful setup to detect failed login/scan of OpenVPN with fail2ban? Or, does anyone know other utility instead of fail2ban?
I have been trying to setup fail2ban to block failed OpenVPN or scan from Internet, but there is no luck.
What I want to do is a program to scan logs and block those failed IP addresses.
Using:
failregex = [a-b]*ovpn-server.*:.<HOST>:[0-9]{4,5} TLS Auth Error:.*
[a-b]*ovpn-server.*:.<HOST>:[0-9]{4,5} VERIFY ERROR:.*
[a-b]*ovpn-server.*:.<HOST>:[0-9]{4,5} TLS Error: TLS handshake failed.*
or
failregex = ^.*\s:[0-9]{4,5} TLS Auth Error:.*
^.*\s:[0-9]{4,5} VERIFY ERROR:.*$
^.*\s:[0-9]{4,5} TLS Error: TLS handshake failed.*$
Won't work (search from Google). I also try to setup it by myself, but it still doesn't work.
Thanks,
Jason
hsinanch
OK, this works after more tries. 😃
failregex = TLS Error: incoming packet authentication failed from \[AF_INET\]<HOST>:*
<HOST>:[0-9]{4,5} Connection reset, restarting \[[0-9]{1,2}\]
<HOST>:[0-9]{4,5} WARNING: Bad encapsulated packet length from peer
