I have a working OpenVPN server setup in my home. Works as it should, all clients (the few I have) can connect and all is working well. However, I´ve started monitoring the message log a little bit. [code]/var/log/messages[/code] and a few times every day I get this: [code]OpenVPN openvpn[4112]: TLS Error: cannot locate HMAC in incoming packet from [AF_INET]146.88.240.4:38254 [/code] Why am I getting this? Is the IP at the end where someone is trying to connect from? I have a few of these, and do not recognize these addresses. Since the only certificates I have issued are for myself and my family, I have a pretty good idea about where connections are comig from. Is there any risk here? What can I do to prevent this, if anything?

It's the normal noise: [code]whois -B 146.88.240.4 NETSCOUT | Arbor Networks Research Scanner [/code]

TLS Error: cannot locate HMAC in incoming packet

dnilgreb

I have a working OpenVPN server setup in my home. Works as it should, all clients (the few I have) can connect and all is working well.
However, I´ve started monitoring the message log a little bit.

/var/log/messages

and a few times every day I get this:

OpenVPN openvpn[4112]: TLS Error: cannot locate HMAC in incoming packet from [AF_INET]146.88.240.4:38254

Why am I getting this? Is the IP at the end where someone is trying to connect from? I have a few of these, and do not recognize these addresses. Since the only certificates I have issued are for myself and my family, I have a pretty good idea about where connections are comig from.

Is there any risk here? What can I do to prevent this, if anything?

Pippin

It's the normal noise:

whois -B 146.88.240.4
NETSCOUT | Arbor Networks Research Scanner

TinCanTech

dnilgreb wrote TLS Error: cannot locate HMAC in incoming packet

This means that openvpn immediately dropped the packet because it does not have the correct HMAC key from --tls-auth.

dnilgreb wrote from [AF_INET]146.88.240.4:38254

This is where the packet came from.

Openvpn officially uses port 1194 and so there are scanners out there searching on port 1194 for vulnerable servers. You can use a different port (security through obscurity) to evade these scanners or use openvpn's security measures (--tls-auth, --tls-crypt and --tls-crypt-v2) to ensure thast the scanners will fail. Or do both ..

If you like to try --tls-crypt-v2 please see https://github.com/TinCanTech/easy-tls

dnilgreb

Great answers, thanks!

So they are indeed attempts to connect to or communicate with my server?
Is it anything to do something about, or can/should I just disregard it as noise?

Any risk to consider?