dsetis Sometimes I have received attempts to connect to my server (not real connections I think), and each one of them, generating entries in my LOGFILE: "TLS Error: cannot locate HMAC in incoming packet from...." Result: 20G logfiles per day, that my rotate can't manage.. What is the best way to solve it? - "verb 0" isn't a good option, i think... - "disable the TLS security?" wrong way ... Any ideas? :ugeek:
dsetis I'm trying indeed with mute 45. But when I try to connect a client without the TLS option, i saw the LOG. If I try four times, I will see 4 lines in log file. So, consecutive attempts (like a attack) ends up filling my disk...
TinCanTech dsetis wrote Result: 20G logfiles per day, <snip> - "verb 0" isn't a good option, What is your current --verb ?
dsetis verb = 1 With "0", I think no LOGS will be generated and its not so good. with 1, the LOG is usefull, the problem is about the TLS attack. With 1, its flooding openvpn.log file
dsetis I was really confused.... I'm so sorry I reversed mute option... 2 = less equals logs. Thanks!!! Its working!
dsetis Now, again.. around 13k per second... With verb 1 and mute 1 The Log: Tue Jul 3 12:08:23 2018 TLS Error: incoming packet authentication failed from 152.240.255.85:35215 Tue Jul 3 12:08:23 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed Tue Jul 3 12:08:23 2018 TLS Error: incoming packet authentication failed from 177.56.233.73:58123 Tue Jul 3 12:08:23 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed Tue Jul 3 12:08:23 2018 TLS Error: incoming packet authentication failed from 189.93.133.108:37127 Tue Jul 3 12:08:23 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed Tue Jul 3 12:08:23 2018 TLS Error: incoming packet authentication failed from 152.240.129.127:48610 Tue Jul 3 12:08:23 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed Tue Jul 3 12:08:23 2018 TLS Error: incoming packet authentication failed from 152.240.114.76:44890 Tue Jul 3 12:08:24 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed Tue Jul 3 12:08:24 2018 TLS Error: incoming packet authentication failed from 152.240.107.107:44177 Tue Jul 3 12:08:24 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed Tue Jul 3 12:08:24 2018 TLS Error: incoming packet authentication failed from 187.69.219.44:34305 Tue Jul 3 12:08:24 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed Tue Jul 3 12:08:24 2018 TLS Error: incoming packet authentication failed from 152.240.224.88:55099 Tue Jul 3 12:08:24 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed Tue Jul 3 12:08:24 2018 TLS Error: incoming packet authentication failed from 152.245.135.126:46313 Tue Jul 3 12:08:24 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed Tue Jul 3 12:08:24 2018 TLS Error: incoming packet authentication failed from 179.86.133.247:53054 Tue Jul 3 12:08:24 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed Tue Jul 3 12:08:24 2018 TLS Error: incoming packet authentication failed from 152.245.160.189:33492
TinCanTech dsetis wrote Now, again.. around 13k per second... With verb 1 and mute 1 So around 1GB per day dsetis wrote 20G logfiles per day down from 20GB per day .. Is that not enough of an improvement ? What do you use for --proto and --port ?
dsetis Sometimes 13k, sometimes 20k, sometimes crazy 150k per second, and sometimes....5k. The rate i used was an example... last friday I had 26GB proto UDP and port 1194 Thank u.
TinCanTech I asked the developers about this but nobody has time to look into it .. it is too low a priority. I may be able to help further, please contact me here : tincanteksup <at> gmail
dsetis No problem. I will disable the entire LOG with "verb 0" and pray to never need to use these "logs history".. Thanks again.
