Intrusion attempt on OpenVPN port?

hashtag

I have a Synology DS218+ on which I am running an OpenVPN server inside a virtual machine (192.168.1.16). Since setting up the server I have noticed repeated entries in my router's log showing accepted packets on the OpenVPN port from unknown IP addresses and I am not sure if I need to be concerned about it. Originally I had the server set on port 443 UDP, but later switched it to the standard port 1194 UDP.

While the router log shows accepted packets, my VPN connection log does not show any login attempts (either failed or successful). The virtual machine is also set to ban IPs on a single failed login attempt and has not banned any IPs. This leads me to think that the connections I am seeing are nothing to worry about and are not making intrusion attempts but I am wondering if anyone can provide further guidance.

Below are examples of the logs I am talking about (the first four on UDP 443 and the last on UDP 1194):

ACCEPT IN=eth0 OUT=br0 SRC=65.49.20.112 DST=192.168.1.16 LEN=1258 TOS=0x00 PREC=0x00 TTL=235 ID=54321 PROTO=UDP SPT=59552 DPT=443 LEN=1238 MARK=0x41000000

ACCEPT IN=eth0 OUT=br0 SRC=62.141.42.49 DST=192.168.1.16 LEN=89 TOS=0x08 PREC=0x40 TTL=234 ID=54321 PROTO=UDP SPT=50006 DPT=443 LEN=69

ACCEPT IN=eth0 OUT=br0 SRC=54.39.215.32 DST=192.168.1.16 LEN=36 TOS=0x00 PREC=0x00 TTL=236 ID=54321 PROTO=UDP SPT=45729 DPT=443 LEN=16 MARK=0x41440111

ACCEPT IN=eth0 OUT=br0 SRC=65.49.20.110 DST=192.168.1.16 LEN=1258 TOS=0x00 PREC=0x00 TTL=236 ID=54321 PROTO=UDP SPT=38220 DPT=443 LEN=1238 MARK=0x414d007e

ACCEPT IN=eth0 OUT=br0 SRC=185.200.118.35 DST=192.168.1.16 LEN=42 TOS=0x08 PREC=0x20 TTL=235 ID=54321 PROTO=UDP SPT=45003 DPT=1194 LEN=22 MARK=0x814d007e

Can anyone help me interpret what is happening here?

Pippin

Version of OpenVPN?
Add

verb 4

to the server config file, restart.
Wait for it and post the log together with the server config file.

TinCanTech

Probably a Matrix scan.

hashtag

The log indicates OpenVPN version 2.3.11. It is included as a part of Synology VPN Center. Another post online suggests Synology is not up to date on including the current OpenVPN release. Config and log below.

Server config (generated by Synology VPN Center, manually edited by me to change verb from 3 to 4)

cat openvpn.conf wrotepush "route 192.168.1.0 255.255.255.0"
push "route 10.8.0.0 255.255.255.0"
dev tun

management 127.0.0.1 1195

server 10.8.0.0 255.255.255.0

dh /var/packages/VPNCenter/target/etc/openvpn/keys/dh3072.pem
ca /var/packages/VPNCenter/target/etc/openvpn/keys/ca.crt
cert /var/packages/VPNCenter/target/etc/openvpn/keys/server.crt
key /var/packages/VPNCenter/target/etc/openvpn/keys/server.key

max-clients 5

persist-tun
persist-key

verb 4

log-append /var/log/openvpn.log

keepalive 10 60
reneg-sec 0

plugin /var/packages/VPNCenter/target/lib/radiusplugin.so /var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf
client-cert-not-required
username-as-common-name
duplicate-cn

status /tmp/ovpn_status_2_result 30
status-version 2
proto udp6
port 1194
cipher AES-256-CBC
auth SHA512

syslog entry in question

ACCEPT IN=eth0 OUT=br0 SRC=146.88.240.4 DST=192.168.1.16 LEN=42 TOS=0x00 PREC=0x00 TTL=238 ID=54321 PROTO=UDP SPT=50471 DPT=1194 LEN=22

OpenVPN log (I bolded the part in the log that appears to be of primary interest at the end)

cat /var/log/openvpn.log wroteWed Oct 21 21:19:01 2020 us=551274 Current Parameter Settings:
Wed Oct 21 21:19:01 2020 us=561942 config = 'openvpn.conf'
Wed Oct 21 21:19:01 2020 us=562045 mode = 1
Wed Oct 21 21:19:01 2020 us=562066 persist_config = DISABLED
Wed Oct 21 21:19:01 2020 us=562084 persist_mode = 1
Wed Oct 21 21:19:01 2020 us=562101 show_ciphers = DISABLED
Wed Oct 21 21:19:01 2020 us=562119 show_digests = DISABLED
Wed Oct 21 21:19:01 2020 us=562136 show_engines = DISABLED
Wed Oct 21 21:19:01 2020 us=562153 genkey = DISABLED
Wed Oct 21 21:19:01 2020 us=562170 key_pass_file = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=562187 show_tls_ciphers = DISABLED
Wed Oct 21 21:19:01 2020 us=562205 Connection profiles [default]:
Wed Oct 21 21:19:01 2020 us=562224 proto = udp6
Wed Oct 21 21:19:01 2020 us=562241 local = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=562258 local_port = 1194
Wed Oct 21 21:19:01 2020 us=562275 remote = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=562292 remote_port = 1194
Wed Oct 21 21:19:01 2020 us=562309 remote_float = DISABLED
Wed Oct 21 21:19:01 2020 us=562326 bind_defined = DISABLED
Wed Oct 21 21:19:01 2020 us=562343 bind_local = ENABLED
Wed Oct 21 21:19:01 2020 us=562360 connect_retry_seconds = 5
Wed Oct 21 21:19:01 2020 us=562377 connect_timeout = 10
Wed Oct 21 21:19:01 2020 us=562394 connect_retry_max = 0
Wed Oct 21 21:19:01 2020 us=562411 socks_proxy_server = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=562428 socks_proxy_port = 0
Wed Oct 21 21:19:01 2020 us=562445 socks_proxy_retry = DISABLED
Wed Oct 21 21:19:01 2020 us=562462 tun_mtu = 1500
Wed Oct 21 21:19:01 2020 us=562479 tun_mtu_defined = ENABLED
Wed Oct 21 21:19:01 2020 us=562499 link_mtu = 1500
Wed Oct 21 21:19:01 2020 us=562516 link_mtu_defined = DISABLED
Wed Oct 21 21:19:01 2020 us=562533 tun_mtu_extra = 0
Wed Oct 21 21:19:01 2020 us=562550 tun_mtu_extra_defined = DISABLED
Wed Oct 21 21:19:01 2020 us=562589 mtu_discover_type = -1
Wed Oct 21 21:19:01 2020 us=562606 fragment = 0
Wed Oct 21 21:19:01 2020 us=562623 mssfix = 1450
Wed Oct 21 21:19:01 2020 us=562640 explicit_exit_notification = 0
Wed Oct 21 21:19:01 2020 us=562657 Connection profiles END
Wed Oct 21 21:19:01 2020 us=562697 remote_random = DISABLED
Wed Oct 21 21:19:01 2020 us=562715 ipchange = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=562732 dev = 'tun'
Wed Oct 21 21:19:01 2020 us=562748 dev_type = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=562765 dev_node = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=562781 lladdr = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=562952 topology = 1
Wed Oct 21 21:19:01 2020 us=563260 tun_ipv6 = DISABLED
Wed Oct 21 21:19:01 2020 us=563290 ifconfig_local = '10.8.0.1'
Wed Oct 21 21:19:01 2020 us=563307 ifconfig_remote_netmask = '10.8.0.2'
Wed Oct 21 21:19:01 2020 us=563324 ifconfig_noexec = DISABLED
Wed Oct 21 21:19:01 2020 us=563340 ifconfig_nowarn = DISABLED
Wed Oct 21 21:19:01 2020 us=563357 ifconfig_ipv6_local = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=563373 ifconfig_ipv6_netbits = 0
Wed Oct 21 21:19:01 2020 us=563390 ifconfig_ipv6_remote = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=563406 shaper = 0
Wed Oct 21 21:19:01 2020 us=563422 mtu_test = 0
Wed Oct 21 21:19:01 2020 us=563439 mlock = DISABLED
Wed Oct 21 21:19:01 2020 us=563456 keepalive_ping = 10
Wed Oct 21 21:19:01 2020 us=563472 keepalive_timeout = 60
Wed Oct 21 21:19:01 2020 us=563489 inactivity_timeout = 0
Wed Oct 21 21:19:01 2020 us=563505 ping_send_timeout = 10
Wed Oct 21 21:19:01 2020 us=563522 ping_rec_timeout = 120
Wed Oct 21 21:19:01 2020 us=563539 ping_rec_timeout_action = 2
Wed Oct 21 21:19:01 2020 us=563570 ping_timer_remote = DISABLED
Wed Oct 21 21:19:01 2020 us=563607 remap_sigusr1 = 0
Wed Oct 21 21:19:01 2020 us=563624 persist_tun = ENABLED
Wed Oct 21 21:19:01 2020 us=563640 persist_local_ip = DISABLED
Wed Oct 21 21:19:01 2020 us=563657 persist_remote_ip = DISABLED
Wed Oct 21 21:19:01 2020 us=563673 persist_key = ENABLED
Wed Oct 21 21:19:01 2020 us=563689 passtos = DISABLED
Wed Oct 21 21:19:01 2020 us=563720 resolve_retry_seconds = 1000000000
Wed Oct 21 21:19:01 2020 us=563747 username = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=563764 groupname = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=563780 chroot_dir = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=563797 cd_dir = '/usr/syno/etc/packages/VPNCenter/openvpn'
Wed Oct 21 21:19:01 2020 us=563814 writepid = '/var/run/ovpn_server.pid'
Wed Oct 21 21:19:01 2020 us=563830 up_script = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=563847 down_script = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=563863 down_pre = DISABLED
Wed Oct 21 21:19:01 2020 us=563880 up_restart = DISABLED
Wed Oct 21 21:19:01 2020 us=563896 up_delay = DISABLED
Wed Oct 21 21:19:01 2020 us=563913 daemon = ENABLED
Wed Oct 21 21:19:01 2020 us=563929 inetd = 0
Wed Oct 21 21:19:01 2020 us=563946 log = ENABLED
Wed Oct 21 21:19:01 2020 us=563962 suppress_timestamps = DISABLED
Wed Oct 21 21:19:01 2020 us=563979 nice = 0
Wed Oct 21 21:19:01 2020 us=563995 verbosity = 4
Wed Oct 21 21:19:01 2020 us=564026 mute = 0
Wed Oct 21 21:19:01 2020 us=564045 gremlin = 0
Wed Oct 21 21:19:01 2020 us=564062 status_file = '/tmp/ovpn_status_2_result'
Wed Oct 21 21:19:01 2020 us=564079 status_file_version = 2
Wed Oct 21 21:19:01 2020 us=564095 status_file_update_freq = 30
Wed Oct 21 21:19:01 2020 us=564112 occ = ENABLED
Wed Oct 21 21:19:01 2020 us=564128 rcvbuf = 0
Wed Oct 21 21:19:01 2020 us=564145 sndbuf = 0
Wed Oct 21 21:19:01 2020 us=564161 mark = 0
Wed Oct 21 21:19:01 2020 us=564178 sockflags = 0
Wed Oct 21 21:19:01 2020 us=564194 fast_io = DISABLED
Wed Oct 21 21:19:01 2020 us=564211 lzo = 0
Wed Oct 21 21:19:01 2020 us=564227 route_script = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=564244 route_default_gateway = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=564261 route_default_metric = 0
Wed Oct 21 21:19:01 2020 us=564278 route_noexec = DISABLED
Wed Oct 21 21:19:01 2020 us=564295 route_delay = 0
Wed Oct 21 21:19:01 2020 us=564431 route_delay_window = 30
Wed Oct 21 21:19:01 2020 us=564450 route_delay_defined = DISABLED
Wed Oct 21 21:19:01 2020 us=564467 route_nopull = DISABLED
Wed Oct 21 21:19:01 2020 us=564483 route_gateway_via_dhcp = DISABLED
Wed Oct 21 21:19:01 2020 us=564511 max_routes = 100
Wed Oct 21 21:19:01 2020 us=564529 allow_pull_fqdn = DISABLED
Wed Oct 21 21:19:01 2020 us=564547 route 10.8.0.0/255.255.255.0/nil/nil
Wed Oct 21 21:19:01 2020 us=564578 management_addr = '127.0.0.1'
Wed Oct 21 21:19:01 2020 us=564595 management_port = 1195
Wed Oct 21 21:19:01 2020 us=564612 management_user_pass = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=564629 management_log_history_cache = 250
Wed Oct 21 21:19:01 2020 us=564646 management_echo_buffer_size = 100
Wed Oct 21 21:19:01 2020 us=564663 management_write_peer_info_file = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=564680 management_client_user = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=564697 management_client_group = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=564714 management_flags = 0
Wed Oct 21 21:19:01 2020 us=564734 plugin[0] /var/packages/VPNCenter/target/lib/radiusplugin.so '[/var/packages/VPNCenter/target/lib/radiusplugin.so] [/var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf]'
Wed Oct 21 21:19:01 2020 us=564753 shared_secret_file = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=564770 key_direction = 0
Wed Oct 21 21:19:01 2020 us=564787 ciphername_defined = ENABLED
Wed Oct 21 21:19:01 2020 us=564804 ciphername = 'AES-256-CBC'
Wed Oct 21 21:19:01 2020 us=564821 authname_defined = ENABLED
Wed Oct 21 21:19:01 2020 us=564838 authname = 'SHA512'
Wed Oct 21 21:19:01 2020 us=564855 prng_hash = 'SHA1'
Wed Oct 21 21:19:01 2020 us=564872 prng_nonce_secret_len = 16
Wed Oct 21 21:19:01 2020 us=564889 keysize = 0
Wed Oct 21 21:19:01 2020 us=564905 engine = DISABLED
Wed Oct 21 21:19:01 2020 us=564922 replay = ENABLED
Wed Oct 21 21:19:01 2020 us=564939 mute_replay_warnings = DISABLED
Wed Oct 21 21:19:01 2020 us=564956 replay_window = 64
Wed Oct 21 21:19:01 2020 us=564973 replay_time = 15
Wed Oct 21 21:19:01 2020 us=564989 packet_id_file = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=565006 use_iv = ENABLED
Wed Oct 21 21:19:01 2020 us=572138 test_crypto = DISABLED
Wed Oct 21 21:19:01 2020 us=572162 tls_server = ENABLED
Wed Oct 21 21:19:01 2020 us=572179 tls_client = DISABLED
Wed Oct 21 21:19:01 2020 us=572196 key_method = 2
Wed Oct 21 21:19:01 2020 us=572214 ca_file = '/var/packages/VPNCenter/target/etc/openvpn/keys/ca.crt'
Wed Oct 21 21:19:01 2020 us=572231 ca_path = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=572249 dh_file = '/var/packages/VPNCenter/target/etc/openvpn/keys/dh3072.pem'
Wed Oct 21 21:19:01 2020 us=572266 cert_file = '/var/packages/VPNCenter/target/etc/openvpn/keys/server.crt'
Wed Oct 21 21:19:01 2020 us=572283 extra_certs_file = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=572300 priv_key_file = '/var/packages/VPNCenter/target/etc/openvpn/keys/server.key'
Wed Oct 21 21:19:01 2020 us=572317 pkcs12_file = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=572334 cipher_list = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=572350 tls_verify = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=572367 tls_export_cert = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=572384 verify_x509_type = 0
Wed Oct 21 21:19:01 2020 us=572401 verify_x509_name = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=572417 crl_file = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=572434 ns_cert_type = 0
Wed Oct 21 21:19:01 2020 us=572451 remote_cert_ku = 0
Wed Oct 21 21:19:01 2020 us=572467 remote_cert_ku = 0
Wed Oct 21 21:19:01 2020 us=572483 remote_cert_ku = 0
Wed Oct 21 21:19:01 2020 us=572500 remote_cert_ku = 0
Wed Oct 21 21:19:01 2020 us=572517 remote_cert_ku = 0
Wed Oct 21 21:19:01 2020 us=572533 remote_cert_ku = 0
Wed Oct 21 21:19:01 2020 us=572550 remote_cert_ku = 0
Wed Oct 21 21:19:01 2020 us=572579 remote_cert_ku = 0
Wed Oct 21 21:19:01 2020 us=572596 remote_cert_ku = 0
Wed Oct 21 21:19:01 2020 us=572613 remote_cert_ku = 0
Wed Oct 21 21:19:01 2020 us=572629 remote_cert_ku[i] = 0
Wed Oct 21 21:19:01 2020 us=572646 remote_cert_ku[i] = 0
Wed Oct 21 21:19:01 2020 us=572663 remote_cert_ku[i] = 0
Wed Oct 21 21:19:01 2020 us=572679 remote_cert_ku[i] = 0
Wed Oct 21 21:19:01 2020 us=572714 remote_cert_ku[i] = 0
Wed Oct 21 21:19:01 2020 us=572731 remote_cert_ku[i] = 0
Wed Oct 21 21:19:01 2020 us=572748 remote_cert_eku = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=572766 ssl_flags = 3
Wed Oct 21 21:19:01 2020 us=572783 tls_timeout = 2
Wed Oct 21 21:19:01 2020 us=572800 renegotiate_bytes = 0
Wed Oct 21 21:19:01 2020 us=572816 renegotiate_packets = 0
Wed Oct 21 21:19:01 2020 us=572833 renegotiate_seconds = 0
Wed Oct 21 21:19:01 2020 us=572850 handshake_window = 60
Wed Oct 21 21:19:01 2020 us=572866 transition_window = 3600
Wed Oct 21 21:19:01 2020 us=572883 single_session = DISABLED
Wed Oct 21 21:19:01 2020 us=572900 push_peer_info = DISABLED
Wed Oct 21 21:19:01 2020 us=572917 tls_exit = DISABLED
Wed Oct 21 21:19:01 2020 us=572933 tls_auth_file = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=572955 server_network = 10.8.0.0
Wed Oct 21 21:19:01 2020 us=572974 server_netmask = 255.255.255.0
Wed Oct 21 21:19:01 2020 us=573043 server_network_ipv6 = ::
Wed Oct 21 21:19:01 2020 us=573064 server_netbits_ipv6 = 0
Wed Oct 21 21:19:01 2020 us=573083 server_bridge_ip = 0.0.0.0
Wed Oct 21 21:19:01 2020 us=573101 server_bridge_netmask = 0.0.0.0
Wed Oct 21 21:19:01 2020 us=573120 server_bridge_pool_start = 0.0.0.0
Wed Oct 21 21:19:01 2020 us=573139 server_bridge_pool_end = 0.0.0.0
Wed Oct 21 21:19:01 2020 us=573156 push_entry = 'route 192.168.1.0 255.255.255.0'
Wed Oct 21 21:19:01 2020 us=573174 push_entry = 'route 10.8.0.0 255.255.255.0'
Wed Oct 21 21:19:01 2020 us=573191 push_entry = 'route 10.8.0.1'
Wed Oct 21 21:19:01 2020 us=573208 push_entry = 'topology net30'
Wed Oct 21 21:19:01 2020 us=573225 push_entry = 'ping 10'
Wed Oct 21 21:19:01 2020 us=573242 push_entry = 'ping-restart 60'
Wed Oct 21 21:19:01 2020 us=573259 ifconfig_pool_defined = ENABLED
Wed Oct 21 21:19:01 2020 us=573277 ifconfig_pool_start = 10.8.0.4
Wed Oct 21 21:19:01 2020 us=573295 ifconfig_pool_end = 10.8.0.251
Wed Oct 21 21:19:01 2020 us=573323 ifconfig_pool_netmask = 0.0.0.0
Wed Oct 21 21:19:01 2020 us=573345 ifconfig_pool_persist_filename = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=573363 ifconfig_pool_persist_refresh_freq = 600
Wed Oct 21 21:19:01 2020 us=573380 ifconfig_ipv6_pool_defined = DISABLED
Wed Oct 21 21:19:01 2020 us=573398 ifconfig_ipv6_pool_base = ::
Wed Oct 21 21:19:01 2020 us=573415 ifconfig_ipv6_pool_netbits = 0
Wed Oct 21 21:19:01 2020 us=573432 n_bcast_buf = 256
Wed Oct 21 21:19:01 2020 us=573449 tcp_queue_limit = 64
Wed Oct 21 21:19:01 2020 us=573466 real_hash_size = 256
Wed Oct 21 21:19:01 2020 us=573482 virtual_hash_size = 256
Wed Oct 21 21:19:01 2020 us=573499 client_connect_script = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=573515 learn_address_script = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=573532 client_disconnect_script = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=573549 client_config_dir = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=573588 ccd_exclusive = DISABLED
Wed Oct 21 21:19:01 2020 us=573606 tmp_dir = '/tmp'
Wed Oct 21 21:19:01 2020 us=573623 push_ifconfig_defined = DISABLED
Wed Oct 21 21:19:01 2020 us=573641 push_ifconfig_local = 0.0.0.0
Wed Oct 21 21:19:01 2020 us=573660 push_ifconfig_remote_netmask = 0.0.0.0
Wed Oct 21 21:19:01 2020 us=573676 push_ifconfig_ipv6_defined = DISABLED
Wed Oct 21 21:19:01 2020 us=573695 push_ifconfig_ipv6_local = ::/0
Wed Oct 21 21:19:01 2020 us=573713 push_ifconfig_ipv6_remote = ::
Wed Oct 21 21:19:01 2020 us=573730 enable_c2c = DISABLED
Wed Oct 21 21:19:01 2020 us=573746 duplicate_cn = ENABLED
Wed Oct 21 21:19:01 2020 us=573763 cf_max = 0
Wed Oct 21 21:19:01 2020 us=573780 cf_per = 0
Wed Oct 21 21:19:01 2020 us=573797 max_clients = 5
Wed Oct 21 21:19:01 2020 us=573813 max_routes_per_client = 256
Wed Oct 21 21:19:01 2020 us=573830 auth_user_pass_verify_script = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=573847 auth_user_pass_verify_script_via_file = DISABLED
Wed Oct 21 21:19:01 2020 us=573864 port_share_host = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=573881 port_share_port = 0
Wed Oct 21 21:19:01 2020 us=573905 client = DISABLED
Wed Oct 21 21:19:01 2020 us=573923 pull = DISABLED
Wed Oct 21 21:19:01 2020 us=573939 auth_user_pass_file = '[UNDEF]'
Wed Oct 21 21:19:01 2020 us=573958 OpenVPN 2.3.11 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Feb 21 2020
Wed Oct 21 21:19:01 2020 us=573985 library versions: OpenSSL 1.0.2u-fips 20 Dec 2019, LZO 2.09
Wed Oct 21 21:19:01 2020 us=591642 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1195
Wed Oct 21 21:19:01 2020 us=591900 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Wed Oct 21 21:19:01 2020 RADIUS-PLUGIN: Configfile name: /var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf.
Wed Oct 21 21:19:01 2020 us=610372 PLUGIN_INIT: POST /var/packages/VPNCenter/target/lib/radiusplugin.so '[/var/packages/VPNCenter/target/lib/radiusplugin.so] [/var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf]' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY|PLUGIN_CLIENT_CONNECT|PLUGIN_CLIENT_DISCONNECT
Wed Oct 21 21:19:01 2020 us=611186 Diffie-Hellman initialized with 3072 bit key
Wed Oct 21 21:19:01 2020 us=611242 WARNING: POTENTIALLY DANGEROUS OPTION --client-cert-not-required may accept clients which do not present a certificate
Wed Oct 21 21:19:01 2020 us=612004 TLS-Auth MTU parms [ L:1601 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Wed Oct 21 21:19:01 2020 us=613516 Socket Buffers: R=[212992->212992] S=[212992->212992]
Wed Oct 21 21:19:01 2020 us=613791 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=eth0 HWADDR=02:11:32:27:0d:78
Wed Oct 21 21:19:01 2020 us=617985 TUN/TAP device tun0 opened
Wed Oct 21 21:19:01 2020 us=618137 TUN/TAP TX queue length set to 100
Wed Oct 21 21:19:01 2020 us=618180 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Oct 21 21:19:01 2020 us=618237 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Wed Oct 21 21:19:01 2020 us=644670 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Wed Oct 21 21:19:01 2020 us=671108 Data Channel MTU parms [ L:1601 D:1450 EF:101 EB:12 ET:0 EL:3 ]
Wed Oct 21 21:19:01 2020 us=671212 UDPv6 link local (bound): [undef]
Wed Oct 21 21:19:01 2020 us=671235 UDPv6 link remote: [undef]
Wed Oct 21 21:19:01 2020 us=671260 MULTI: multi_init called, r=256 v=256
Wed Oct 21 21:19:01 2020 us=671336 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Wed Oct 21 21:19:01 2020 us=671388 Initialization Sequence Completed
Wed Oct 21 22:17:10 2020 us=569952 MULTI: multi_create_instance called
Wed Oct 21 22:17:10 2020 us=570155 ::ffff:146.88.240.4(50471) Re-using SSL/TLS context
Wed Oct 21 22:17:10 2020 us=570366 ::ffff:146.88.240.4(50471) Control Channel MTU parms [ L:1601 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Wed Oct 21 22:17:10 2020 us=570394 ::ffff:146.88.240.4(50471) Data Channel MTU parms [ L:1601 D:1450 EF:101 EB:12 ET:0 EL:3 ]
Wed Oct 21 22:17:10 2020 us=570454 ::ffff:146.88.240.4(50471) Local Options String: 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
Wed Oct 21 22:17:10 2020 us=570478 ::ffff:146.88.240.4(50471) Expected Remote Options String: 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
Wed Oct 21 22:17:10 2020 us=570524 ::ffff:146.88.240.4(50471) Local Options hash (VER=V4): 'aafdd1dc'
Wed Oct 21 22:17:10 2020 us=570551 ::ffff:146.88.240.4(50471) Expected Remote Options hash (VER=V4): 'fdf9820a'
Wed Oct 21 22:17:10 2020 us=570631 ::ffff:146.88.240.4(50471) TLS: Initial packet from [AF_INET6]::ffff:146.88.240.4:50471, sid=12121212 12121212
Wed Oct 21 22:18:10 2020 us=471215 ::ffff:146.88.240.4(50471) TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Wed Oct 21 22:18:10 2020 us=474447 ::ffff:146.88.240.4(50471) SYNO_ERR_CERT
Wed Oct 21 22:18:10 2020 us=474535 ::ffff:146.88.240.4(50471) TLS Error: TLS handshake failed
Wed Oct 21 22:18:10 2020 us=474768 ::ffff:146.88.240.4(50471) SIGUSR1[soft,tls-error] received, client-instance restarting

This is what I found when I did an iplookup on 146.88.240.4.

https://www.arbor-observatory.com/ wroteWhy am I receiving connection attempts from this machine?

The Threat Intelligence division at NETSCOUT|Arbor (prev. Arbor Networks) has an Internet safety initiative which identifies services that can potentially be abused by attackers. Internet scanning is often viewed as a malicious activity but can also be used by crawlers and other large-scale scanners to drive traffic, obtain useful statistics, and in our case gather knowledge that will go towards making the Internet a safer place.

....

hashtag

Four more occurrences during the night (Note the second and third IP are the same but the source port changed. Only one source port for that IP is reflected in the OpenVPN log though)

ACCEPT IN=eth0 OUT=br0 SRC=167.248.133.17 DST=192.168.1.16 LEN=42 TOS=0x08 PREC=0x40 TTL=31 ID=38145 PROTO=UDP SPT=12308 DPT=1194 LEN=22

ACCEPT IN=eth0 OUT=br0 SRC=167.248.133.52 DST=192.168.1.16 LEN=42 TOS=0x08 PREC=0x40 TTL=45 ID=49513 DF PROTO=UDP SPT=55457 DPT=1194 LEN=22

ACCEPT IN=eth0 OUT=br0 SRC=167.248.133.52 DST=192.168.1.16 LEN=42 TOS=0x08 PREC=0x40 TTL=45 ID=53019 DF PROTO=UDP SPT=60808 DPT=1194 LEN=22

ACCEPT IN=eth0 OUT=br0 SRC=185.200.118.88 DST=192.168.1.16 LEN=42 TOS=0x08 PREC=0x20 TTL=235 ID=54321 PROTO=UDP SPT=45604 DPT=1194 LEN=22

Thu Oct 22 00:50:56 2020 us=46483 MULTI: multi_create_instance called
Thu Oct 22 00:50:56 2020 us=46641 ::ffff:167.248.133.17(12308) Re-using SSL/TLS context
Thu Oct 22 00:50:56 2020 us=46820 ::ffff:167.248.133.17(12308) Control Channel MTU parms [ L:1601 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Thu Oct 22 00:50:56 2020 us=46849 ::ffff:167.248.133.17(12308) Data Channel MTU parms [ L:1601 D:1450 EF:101 EB:12 ET:0 EL:3 ]
Thu Oct 22 00:50:56 2020 us=46903 ::ffff:167.248.133.17(12308) Local Options String: 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
Thu Oct 22 00:50:56 2020 us=46927 ::ffff:167.248.133.17(12308) Expected Remote Options String: 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
Thu Oct 22 00:50:56 2020 us=46959 ::ffff:167.248.133.17(12308) Local Options hash (VER=V4): 'aafdd1dc'
Thu Oct 22 00:50:56 2020 us=46985 ::ffff:167.248.133.17(12308) Expected Remote Options hash (VER=V4): 'fdf9820a'
Thu Oct 22 00:50:56 2020 us=47079 ::ffff:167.248.133.17(12308) TLS: Initial packet from [AF_INET6]::ffff:167.248.133.17:12308, sid=4d658221 07fcfd52
Thu Oct 22 00:51:56 2020 us=241191 ::ffff:167.248.133.17(12308) TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Oct 22 00:51:56 2020 us=245069 ::ffff:167.248.133.17(12308) SYNO_ERR_CERT
Thu Oct 22 00:51:56 2020 us=245156 ::ffff:167.248.133.17(12308) TLS Error: TLS handshake failed
Thu Oct 22 00:51:56 2020 us=245349 ::ffff:167.248.133.17(12308) SIGUSR1[soft,tls-error] received, client-instance restarting

Thu Oct 22 00:51:11 2020 us=205856 MULTI: multi_create_instance called
Thu Oct 22 00:51:11 2020 us=206924 ::ffff:167.248.133.52(60808) Re-using SSL/TLS context
Thu Oct 22 00:51:11 2020 us=207262 ::ffff:167.248.133.52(60808) Control Channel MTU parms [ L:1601 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Thu Oct 22 00:51:11 2020 us=207294 ::ffff:167.248.133.52(60808) Data Channel MTU parms [ L:1601 D:1450 EF:101 EB:12 ET:0 EL:3 ]
Thu Oct 22 00:51:11 2020 us=207352 ::ffff:167.248.133.52(60808) Local Options String: 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
Thu Oct 22 00:51:11 2020 us=207376 ::ffff:167.248.133.52(60808) Expected Remote Options String: 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
Thu Oct 22 00:51:11 2020 us=207408 ::ffff:167.248.133.52(60808) Local Options hash (VER=V4): 'aafdd1dc'
Thu Oct 22 00:51:11 2020 us=207435 ::ffff:167.248.133.52(60808) Expected Remote Options hash (VER=V4): 'fdf9820a'
Thu Oct 22 00:51:11 2020 us=207493 ::ffff:167.248.133.52(60808) TLS: Initial packet from [AF_INET6]::ffff:167.248.133.52:60808, sid=a66dfb23 0779acf1
Thu Oct 22 00:52:11 2020 us=304170 ::ffff:167.248.133.52(60808) TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Oct 22 00:52:11 2020 us=307241 ::ffff:167.248.133.52(60808) SYNO_ERR_CERT
Thu Oct 22 00:52:11 2020 us=307330 ::ffff:167.248.133.52(60808) TLS Error: TLS handshake failed
Thu Oct 22 00:52:11 2020 us=307526 ::ffff:167.248.133.52(60808) SIGUSR1[soft,tls-error] received, client-instance restarting

Thu Oct 22 03:59:15 2020 us=339147 MULTI: multi_create_instance called
Thu Oct 22 03:59:15 2020 us=339325 ::ffff:185.200.118.88(45604) Re-using SSL/TLS context
Thu Oct 22 03:59:15 2020 us=339482 ::ffff:185.200.118.88(45604) Control Channel MTU parms [ L:1601 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Thu Oct 22 03:59:15 2020 us=339511 ::ffff:185.200.118.88(45604) Data Channel MTU parms [ L:1601 D:1450 EF:101 EB:12 ET:0 EL:3 ]
Thu Oct 22 03:59:15 2020 us=339561 ::ffff:185.200.118.88(45604) Local Options String: 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
Thu Oct 22 03:59:15 2020 us=339606 ::ffff:185.200.118.88(45604) Expected Remote Options String: 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
Thu Oct 22 03:59:15 2020 us=339640 ::ffff:185.200.118.88(45604) Local Options hash (VER=V4): 'aafdd1dc'
Thu Oct 22 03:59:15 2020 us=339666 ::ffff:185.200.118.88(45604) Expected Remote Options hash (VER=V4): 'fdf9820a'
Thu Oct 22 03:59:15 2020 us=339731 ::ffff:185.200.118.88(45604) TLS: Initial packet from [AF_INET6]::ffff:185.200.118.88:45604, sid=12121212 12121212
Thu Oct 22 04:00:15 2020 us=929197 ::ffff:185.200.118.88(45604) TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Oct 22 04:00:15 2020 us=932619 ::ffff:185.200.118.88(45604) SYNO_ERR_CERT
Thu Oct 22 04:00:15 2020 us=932711 ::ffff:185.200.118.88(45604) TLS Error: TLS handshake failed
Thu Oct 22 04:00:15 2020 us=932944 ::ffff:185.200.118.88(45604) SIGUSR1[soft,tls-error] received, client-instance restarting