ovpn-server1 Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1627

[nick_max]

Hi,

I have a recent issue linked to an OperVPN server installed on ASUS AC88U router with Merlin firmware 384.7_2.
I have configured this new router from scratch, including the OpenVPN server.

The problem is that my syslog is flooded by hundreds of messages, at few seconds interval, like the one below:

Nov 27 13:16:18 ovpn-server1[16255]: TCP connection established with [AF_INET6]::ffff:192.168.1.2:9509
Nov 27 13:16:18 ovpn-server1[16255]: 192.168.1.2 WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1627 -- please ens
ure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Nov 27 13:16:18 ovpn-server1[16255]: 192.168.1.2 Connection reset, restarting [0]

And all the above errors are coming from almost all devices from intranet, i.e. laptop, phone, tablet, etc.
I tried to google this issue, but couldn't find anything useful.

This is driving me crazy... Am I missing something?

Thank you for your help.


Nick

 

[nick_max]

Hello again,

This is getting ridiculous, my syslog is flooded with messages like this.

Does anyone know why this is happening, please?

 

[Martineau]

Hello again,

This is getting ridiculous, my syslog is flooded with messages like this.

Does anyone know why this is happening, please?

View attachment 15432

Which port is your OpenVPN Server listening on? - i.e. clearly port 80/443 would be bad!

Try changing it to an obscure port to see if the message flood stops.

 

[nick_max]

Hi Martineau,

Thank you for your reply.

Indeed, my OpenVPN server is listening on 443, but it has to because of the environment I am connecting from (where only 80 and 443 are open to internet).

Thing is I've been using OpenVPN on Asus-Merlin for a while now and up until recently I wasn't getting these messages and everything was fine. I figure either I've made a setting somewhere which triggered this problem, or the recent firmwares changed something in the workings of OpenVPN...
I have no idea...

Cheers

 

[Martineau]

Hi Martineau,

Thank you for your reply.

Indeed, my OpenVPN server is listening on 443, but it has to because of the environment I am connecting from (where only 80 and 443 are open to internet).

Thing is I've been using OpenVPN on Asus-Merlin for a while now and up until recently I wasn't getting these messages and everything was fine. I figure either I've made a setting somewhere which triggered this problem, or the recent firmwares changed something in the workings of OpenVPN...
I have no idea...

Cheers

Are you using pixel-serv? etc.

 

[nick_max]

Are you using pixel-serv? etc.

Yes, I'm using Diversion 4.0.5 and Pixelserv-tls 2.1.2, but I've configured it to use 81 for http and 2443 for https, to not interfere with OpenVPN listening port.

 

[RMerlin]

Running anything on port 443 is sure to be bombarded by connection attempts from spiders, bots and malwares.

If your corporate firewall isn't properly tuned in then maybe they have 443/UDP open - give it a try. Port scanners would only hit 443/TCP.

And make sure your corporate IT department isn't going to flip out if they ever discover you are using an outbound VPN connection - they might have corporate reasons to only open these ports. In some companies this might be enough to get you fired if they ever find out, so best to check...

If your remote point has a static IP, then you could probably configure a firewall rule to only allow connections from that IP.

 

[nick_max]

Hi Merlin,

Thank you for your reply.

I already checked 443/UDP is closed. Also, my remote point has a static IP and I've already configured that using iptables (with your help ).

My problem is that the connections to OpenVPN server come from inside my LAN. Furthermore, I've started to see this behavior since I've updated the firmware to 384.7 or 384.7_2, if I remember correctly.

 

[RMerlin]

My problem is that the connections to OpenVPN server come from inside my LAN.

Check what's running on that client. Most likely this is a security suite that does LAN port scanning.

 

[nick_max]

Check what's running on that client. Most likely this is a security suite that does LAN port scanning.

The connection attempts from LAN come from almost all devices connected to the router: smartphones, laptops.
I was under the impression that OpenVPN listens to connection attempts only on ppp0 interface...

 

[wiz]

you can create a firewall rule to block internal traffic to port 443?

 

[RMerlin]

The connection attempts from LAN come from almost all devices connected to the router: smartphones, laptops.
I was under the impression that OpenVPN listens to connection attempts only on ppp0 interface...

The log shows them all coming from 192.168.1.2. Check on that device what might be trying to access port 443 of your router.

 

[sfx2000]

Running anything on port 443 is sure to be bombarded by connection attempts from spiders, bots and malwares.

If your corporate firewall isn't properly tuned in then maybe they have 443/UDP open - give it a try. Port scanners would only hit 443/TCP.

And make sure your corporate IT department isn't going to flip out if they ever discover you are using an outbound VPN connection - they might have corporate reasons to only open these ports. In some companies this might be enough to get you fired if they ever find out, so best to check...

In most corp/enterprise networks, running a rouge OpenVPN endpoint is a fast track to a mutual meeting with the IT Folks and Human Resources - HR is there to brief one on post-separation benefits (if any)...

 

[nick_max]

Hello again in a new year

I am reviving this thread with a question, please:
Is someone able to help me make some iptables rules for my AX88U to block access to the OpenVPN server from intranet and from VPN clients themselves, please?

I'm asking this because my syslog is continuously flooded by unnecessary messages:

Jan 14 14:14:59 ovpn-server1[16876]: 192.168.1.2:65089 WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1627 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Jan 14 14:14:59 ovpn-server1[16876]: 192.168.1.2:65089 Connection reset, restarting [0]
Jan 14 14:14:59 ovpn-server1[16876]: 192.168.1.2:65089 SIGUSR1[soft,connection-reset] received, client-instance restarting
Jan 14 14:15:01 ovpn-server1[16876]: TCP connection established with [AF_INET]192.168.1.2:65092
Jan 14 14:15:01 ovpn-server1[16876]: 192.168.1.2:65092 WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1627 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Jan 14 14:15:01 ovpn-server1[16876]: 192.168.1.2:65092 Connection reset, restarting [0]
Jan 14 14:15:01 ovpn-server1[16876]: 192.168.1.2:65092 SIGUSR1[soft,connection-reset] received, client-instance restarting

Any help is greatly appreciated.

Cheers

 

[SomeWhereOverTheRainBow]

Hello again in a new year

I am reviving this thread with a question, please:
Is someone able to help me make some iptables rules for my AX88U to block access to the OpenVPN server from intranet and from VPN clients themselves, please?

I'm asking this because my syslog is continuously flooded by unnecessary messages:

Jan 14 14:14:59 ovpn-server1[16876]: 192.168.1.2:65089 WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1627 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Jan 14 14:14:59 ovpn-server1[16876]: 192.168.1.2:65089 Connection reset, restarting [0]
Jan 14 14:14:59 ovpn-server1[16876]: 192.168.1.2:65089 SIGUSR1[soft,connection-reset] received, client-instance restarting
Jan 14 14:15:01 ovpn-server1[16876]: TCP connection established with [AF_INET]192.168.1.2:65092
Jan 14 14:15:01 ovpn-server1[16876]: 192.168.1.2:65092 WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1627 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Jan 14 14:15:01 ovpn-server1[16876]: 192.168.1.2:65092 Connection reset, restarting [0]
Jan 14 14:15:01 ovpn-server1[16876]: 192.168.1.2:65092 SIGUSR1[soft,connection-reset] received, client-instance restarting

Any help is greatly appreciated.

Cheers

Why not just turn it off

 

[nick_max]

Why not just turn it off

Because I'm using it

 

[SomeWhereOverTheRainBow]

Because I'm using it

No the device 192.168.1.2

 

[nick_max]

No the device 192.168.1.2

Because this happens with all my LAN devices, I cannot turn them all off. 192.168.1.2 is just an example from the syslog.

 

[SomeWhereOverTheRainBow]

Change verbosity on server to 6.

 

[nick_max]

Change verbosity on server to 6.

Can I ask why?