is this a sign of ipv6 hacking?

Post Reply
seandex
OpenVPN User
Posts: 13
Joined: Mon Jun 20, 2016 5:00 pm

is this a sign of ipv6 hacking?

Post by seandex » Thu Jan 31, 2019 3:17 pm

I spot something in the log
---------------------------------
2019-01-08 08:53:08-0800 [-] VPN Auth Failed: 'DEFAULT_USER6: IP6 address pool depleted: omi/auth:546,internet/defer:746,sagent/user
svc:1295,sagent/usersvc:615,sagent/usersvc:145,sagent/usersvc:270,sagent/usersvc:228,sagent/usersvc:209,<string>:1,sagent/sagent_ent
ry:17,util/mycprof:11,<string>:1,sagent/sagent_entry:14,sagent/sagent_entry:11,util/daemon:28,util/daemon:69,application/app:423,scr
ipts/_twistd_unix:202,application/app:445,application/app:348,internet/base:1166,internet/base:1175,internet/base:779,util/defer:195
,internet/defer:829,internet/defer:746,sagent/usersvc:1295,sagent/usersvc:615,sagent/usersvc:145,sagent/usersvc:270,sagent/usersvc:2
28,sagent/usersvc:209,util/error:61,util/error:44 (VPN_AUTH)' [None]

and keys that i never seen before added as below
------------------------------------------------------------
"ip6tables.vpn.disable.filter": "true"
"ip6tables.vpn.disable.mangle": "true"
"vpn.routing6.enable": "true"
"vpn.server.daemon.vpn_network6.0": "fd4a:xxx:xxxxxxxxxxxxxx"
"vpn.server.nat6": "false"

:o

novaflash
I should be on the dev team.
Posts: 950
Joined: Fri Apr 13, 2012 8:43 pm

Re: is this a sign of ipv6 hacking?

Post by novaflash » Thu Jan 31, 2019 7:58 pm

No, just means your IP address pool is exhausted.

seandex
OpenVPN User
Posts: 13
Joined: Mon Jun 20, 2016 5:00 pm

Re: is this a sign of ipv6 hacking?

Post by seandex » Fri Feb 01, 2019 6:57 am

Thank you very much for the reply!
I never enabled ipv6 keys.. how did that happen?
and it disabled nat and filters..

novaflash
I should be on the dev team.
Posts: 950
Joined: Fri Apr 13, 2012 8:43 pm

Re: is this a sign of ipv6 hacking?

Post by novaflash » Fri Feb 01, 2019 2:34 pm

Well, if you didn't do that, somebody did. But the error message itself doesn't mean you've been hacked, it's just an error message. But if you didn't make these changes, then somebody else did, and that might be an indication that "you got hacked".

Post Reply