Protect OpenVPN server

[Mikiya]

Hi
I've searched here but i can't find a way to do what i want to protect my openvpn server so ...
I know fail2ban (use it on other computers), i know merlin do not want to use it because of python, and i've read posts about ipset scripts to protect from some IPs (by country or malicious lists).
BUT i can't find out how can i protect my openvpn from brute force. With fail2ban, it's quite simple to set a regex from the log file, but without it, i don't know.
Have you find a solution for that ?
Thank you !

 

[RMerlin]

If you use 1024 or 2048 bit certificates, brute-forcing through OpenVPN would take years. I wouldn't worry about it.

You could also move OpenVPN to a different port than 1194, so malicious users won't be able to find it.

 

[Mikiya]

I use the default generated certificates (directly generated by router when server is activated) for server, and couple User/Password, with HMAC protection over tls-auth. I don't know if it's robust enough (with a strong password obviously), that's why i wanted to protect from bruteforce. But as you said, maybe use user certificates could solve this if they are stronger.

 

[RASG]

i prevent other countries from even trying to connect by setting the INPUT chain policy to DROP,
and after that adding the addresses that are allowed to connect to my router.
there is a ipset rule allowing any ip from my country, localhost, internal networks, etc..

ramon@ac66u:/tmp/home/root# iptables -nvL

Chain INPUT (policy DROP 3162 packets, 201K bytes)
 pkts bytes target     prot opt in     out     source               destination       
 2021  110K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           set CountryWhitelist_br src
 107K   22M ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0         
 121K   24M ACCEPT     all  --  *      *       192.168.0.0/16       0.0.0.0/0         
40845   58M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 255