potential attacks (TLS handshake failed messages)

draht

'lo,

I'm seeing an excessive and increasing amount of messages in the logs like

Nov 19 04:43:44 v8 openvpn[30213]: <ip-address> TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Nov 19 04:43:44 v8 openvpn[30213]: <ip-address> TLS Error: TLS handshake failed

The server is on 1194/UDP.

from hundreds of IPv4 addresses across the globe. I'm currently blocking them using a fail2ban setup, and the filters say that some addresses still send hundreds of packets even though they don't see any responses.

Normally, I wouldn't think that this is a problem, but the tendency is a strong increase, which may suggest that there is some exploit circulating that hasn't made it to the news yet.

A traffic capture is available on request.

Does anyone have any more information?

Thanks,
Roman.

TinCanTech

You should probably consider using --tls-auth or --tls-crypt

draht

TinCanTech wrote You should probably consider using --tls-auth or --tls-crypt

This certainly makes sense, yes. It is a compatibility problem, to some degree, but it's fixable.

Besides the countermeasures - is there anything floating around in the wild?