OpenVPN connection without logging in (384.5)?

[Morac]

I run TCP OpenVPN on Merlin 384.5 using public/private ECDSA keys with HMAC filtering. I noticed the following in my router logs today:

Jun  5 20:17:50 ovpn-server2[17243]: TCP connection established with [AF_INET6]::ffff:5.39.223.84:38764
Jun  5 20:17:50 ovpn-server2[17243]: 5.39.223.84 Connection reset, restarting [0]
Jun  5 20:17:50 ovpn-server2[17243]: 5.39.223.84 SIGUSR1[soft,connection-reset] received, client-instance restarting
Jun  5 20:17:54 ovpn-server2[17243]: TCP connection established with [AF_INET6]::ffff:5.39.223.84:20932
Jun  5 20:18:09 ovpn-server2[17243]: 5.39.223.84 Connection reset, restarting [0]
Jun  5 20:18:09 ovpn-server2[17243]: 5.39.223.84 SIGUSR1[soft,connection-reset] received, client-instance restarting
Jun  5 20:18:12 ovpn-server2[17243]: TCP connection established with [AF_INET6]::ffff:5.39.223.84:24100
Jun  5 20:18:27 ovpn-server2[17243]: 5.39.223.84 Connection reset, restarting [0]
Jun  5 20:18:27 ovpn-server2[17243]: 5.39.223.84 SIGUSR1[soft,connection-reset] received, client-instance restarting

That appears to be indicating that someone connected using IPv6 (though the address is an IPv4 one) and somehow stayed connected to the OpenVPN server on my router for 15 minutes before disconnecting. It doesn’t show logging in, but I find that very odd.

Does OpenVPN not time out connections that don’t log in or did this person somehow bypass the login? Of note, I’ve seen a fair number of connection attempts from the Netherlands lately.

 

[isomorphic]

I'm getting these from throughout 185.200.118.0/24. I also have OpenVPN key auth only (no passwords). It could just be someone scanning port 1194. There was someone in another thread seeing similar connections from 95.57.241.69.

Regarding the AF_INET6, I think OpenVPN (on Merlin) claims addresses as IPv6, but I have IPv6 disabled. It may be an OpenVPN quirk and not anything nefarious.

 

[Jack Yaz]

It's 15s not minutes and they're making the initial connection but where they don't have the correct certificate the connection fails.

If you're running on a standard port this is to be expected as bots scan looking for unsecured servers. Nothing to worry about, just normal Internet noise.

 

[DonnyJohnny]

If you have Skynet installed, you will see lesser of these as it blocked common known scanner before the openvpn initialize.
As said, Internet noise (port scanner) is there and every second. Change port if you are really concern with flooding of your syslog,

 

[RMerlin]

I'm getting a lot of malicious connection attempts myself lately from that 5.x.y.z subnet.

No, they did not use IPv6, it's just that OpenVPN handles connectionl IPs as if they were IPv6.