Was I being Hacked?

[JT Strickland]

I was doing a periodic check on my router, and saw there were 3 then 2 then 1 then 0 UNDEF users logged into my VPN server, and only one person, my accountant, is supposed to come in that door.
I checked my log, and it was filled with these, with varying addresses:

Sep 28 04:38:52 RT-AX86U-CB28 ovpn-server1[5343]: 45.164.16.135:80 TLS: Initial packet from [AF_INET]45.164.16.135:80 (via [AF_INET].xxx.xxx.xxx%eth0), sid=xxxxxxxx xxxxxxxx
Sep 28 04:39:52 RT-AX86U-CB28 ovpn-server1[5343]: 45.164.16.135:80 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sep 28 04:39:52 RT-AX86U-CB28 ovpn-server1[5343]: 45.164.16.135:80 TLS Error: TLS handshake failed
Sep 28 04:39:52 RT-AX86U-CB28 ovpn-server1[5343]: 45.164.16.135:80 SIGUSR1[soft,tls-error] received, client-instance restarting

I turned off access to the server, then turned off the server. Scared me, never have seen that before. About all of them were from port 5343, or I assume that's what that is, but the IP varied.
Am I got?

 

[dev_null]

It seems somebody found your port and is probing it. Everything is working as intended (TLS negotiation failed) because they didn't authenticate and weren't permitted a connection.

When this happened to me I switched external ports (to a higher port number).

 

[JT Strickland]

Thanks, I will try that. I knew that had "wrong" wrote all over it.
Knowing me, I probably posted that port number.

 

[L&LD]

Don't trust accountants!

 

[RMerlin]

You're using port 80. Tons of bots will scan ports 80/443, so that's a bad idea.

 

[JT Strickland]

You're using port 80. Tons of bots will scan ports 80/443, so that's a bad idea.

I thought I had changed that, but I will now!
I expected Skynet would catch it, but I suppose it didn't because they were coming in through openvpn.

 

[ColinTaylor]

I thought I had changed that, but I will now!

You probably did. The port 80 shown in the log is the source port of the person connecting (which in itself is unusual). It's an easy mistake to make.

 

[kernol]

Alienvault has info on that ip address ...
https://otx.alienvault.com/indicator/ip/45.164.16.135
Assuming its not spoofed?

 

[JT Strickland]

Alienvault has info on that ip address ...
https://otx.alienvault.com/indicator/ip/45.164.16.135
Assuming its not spoofed?

How about that. I ought to check out some of the others and see if they're on the naughty list.