How to block random VPN attempts

Gertjan

@pwood999 said in How to block random VPN attempts:

Wan to Localhost

That solution, needs one step more : the NAT rule coupled with the firewall rule.
Have the VPN service/process listen on the WAN interface, that's where the traffic comes in.
This needs a firewall PASS rule (not a firewall+NAT rule) that can be set up with to match :
Protocol used
Destination Port
Source Addresses

The destination would be "This firewall" as it includes the WAN IP.

NollipfSense

@Gertjan said in How to block random VPN attempts:

That solution, needs one step more : the NAT rule coupled with the firewall rule.
Have the VPN service/process listen on the WAN interface, that's where the traffic comes in.
This needs a firewall PASS rule (not a firewall+NAT rule) that can be set up with to match :
Protocol used
Destination Port
Source Addresses

The problem here is the OP is using a road warrior where the source address is unknown.

I had been thinking to use schedule so things are not left open all the time...that's what attracted me to pfSense.

johnpoz

@NollipfSense said in How to block random VPN attempts:

The problem here is the OP is using a road warrior where the source address is unknown.

True.. But you can take an educated guess for example that it would be some IP from the US only.. Or some other country where your users reside.. Etc..

I have no idea what IP my plex users might come from.. But pretty sure it won't be from Russia or China, etc.. Or any other IP other than some US ip.. Same goes for users connecting to my openvpn, etc.

So I created this list of IPs that are allowed.

Now I use those in my forwards/Rules - so only included in that allowPfb list are allowed to talk to those ports and services that are forwarded.

I have a family member currently living in Morocco is why those are included.. And I allow IPs from status cake and uptime robot - since they might be from outside the US, they change now and then. And then the service from plex to check if your plex is available remotely - which also can be from international IPs..

Now allowing any IP from US is pretty open, but is far less open than the whole planet ;)

NollipfSense

@johnpoz To me, schedule is the best solution as only I know the schedule...I cannot see any situation where schedule wouldn't work for a road warrior setup...the best thing about pfSense firewall to me.

johnpoz

@NollipfSense you can for sure use schedules as well.. But if you don't limit what IPs can talk.. Which is what the OP was asking about, during your scheduled allowed time, he would be seeing the same random connection attempts - which he doesn't want to see.

Patch

@NollipfSense said in How to block random VPN attempts:

wouldn't work for a road warrior setup...

Yes he wants to allow road warrior access but what is known about valid road warrior users?

is it only the time of day access starts?
are all countries valid?
is access required from all telcos?
is access required from known bad internet addresses
is access required from external vpn suppliers

For my use case the answer to all the above is no. I also use a white list of specific IP4 & URL addresses I know are OK and which pfblocker does not log for me.

Unfortunately before I can use IP6 I would need pfsense to support an alias with masking the least significant portion of addresses to turn device addresses back to site addresses.

NollipfSense

OP reminds me of myself back in 2013 when I first setup a l2tp over IPsec then, discovered lots of folks banging on my firewall door...that was Mikrotik, but then comes 2016 I discovered pfSense...it had a firewall schedule...hooray.

Now, I can set a schedule that only I know so when I am on the road, road warrior-ing, I don't need to leave the VPN door unarmed 24/7 waiting for my key or any key...I schedule a time in advance when to put my key in and turn the knob.

Gertjan

@NollipfSense said in How to block random VPN attempts:

The problem here is the OP is using a road warrior where the source address is unknown.

A good reason to set Source address to "*" or 'everybody'.

So everybody, using protocol 'X' and going to destination port 'Y'.

Because @MarioG wants to block random OpenVPN server access attempts, I see (I'm repeating what has been proposed already) :

above the OpenVPN server pass rule : block IPs that want to use protocol X and destination port Y.
Use an alias as "Source Adrress' in the OpenVPN server access rule that contains IP that are allowed.

or a combination of the two.

SteveITS

@MarioG if the remote PCs have dynamic DNS clients on them you can allow only those dyndns hostnames. Otherwise maybe by country as suggested, or maybe ASN (IP blocks).

johnpoz

@SteveITS yeah ddns is also an option.. To limit to specific known clients - that is a good option as well. If your users are smart enough to do that. But it doesn't really work with say phones - that love to change their IP as they move towers etc.

JKnott

@NollipfSense said in How to block random VPN attempts:

OP reminds me of myself back in 2013 when I first setup a l2tp over IPsec then, discovered lots of folks banging on my firewall door...

After reading that, I left Packet Capture running overnight, watching for attempts to connect to my OpenVPN. I saw only 5 attempts, all from different addresses and none had more than a single packet.

23:44:36.016993 IP 64.20.37.190.36695 > 99.246.121.125.1194: UDP, length 14
03:30:16.965371 IP6 2607:ff10:594:c8::e.56666 > 2607:fea8:4c82:5900:202:55ff:fe47:e07b.1194: UDP, length 18
04:25:20.254762 IP 205.210.31.53.52898 > 99.246.121.125.1194: UDP, length 18
04:44:40.743888 IP 38.132.109.107.48280 > 99.246.121.125.1194: UDP, length 14
06:11:27.663894 IP 144.126.201.49.51303 > 99.246.121.125.1194: UDP, length 19

My addresses have been changed to protect the guilty.

OpenVPN Protocol
Type: 0x38 [opcode/key_id]
0011 1... = Opcode: P_CONTROL_HARD_RESET_CLIENT_V2 (0x07)
.... .000 = Key ID: 0
Session ID: 7647933796043154430
Message Packet-ID Array Length: 0
Message Packet-ID: 0

As you can see, there's no response from pfSense.

JKnott

@johnpoz said in How to block random VPN attempts:

that love to change their IP as they move towers etc.

Do they?

I have done a bit of work on cell networks, for two different carriers. A few months ago, I was also doing some work in the local office of my ISP/cable company/cell carrier. All the servers were located in the office and not at the cell sites. Also, there's a fair bit of cell network underneath the IP layers, to connect the phones to the office. At the cell sites, there are Ethernet switches but not routers, so no local means of providing IP addresses.

johnpoz

@JKnott said in How to block random VPN attempts:

Do they?

Tmobile does for damn sure - I can not walk down the block with out bunch of different IPs being used. I have tautulli setup to email when new Ips are used by a client.. Normally its just now and then.. But from phones I can get a flood of them..

It could have to do with cells that only get IPv6 and have to go through the carriers translation to IPv4..

Not saying it happens ever single time - but it can for sure happen. I turned of email notifications on my phone for them - because when I was talking a walk and listening to music off my plex, I would keep getting popups on my phone when another email came in about a new IP, etc

serbus

@NollipfSense said in How to block random VPN attempts:

To me, schedule is the best solution as only I know the schedule...I cannot see any situation where schedule wouldn't work for a road warrior setup...the best thing about pfSense firewall to me.

Hello!

Not sure I understand the complete use case, but maybe some form of port-knocking would be an option...

fwknop
https://redmine.pfsense.org/issues/8547

John

JKnott

@johnpoz

I've never used T-Mobile. I've only roamed on AT&T when in the U.S.. The carriers I've worked on are Rogers and Wind/Freedom. I first worked on the Wind network when they were getting ready to start up and later, as Freedom, to upgrade the power supplies and batteries. I was working on Rogers for their LTE rollout and more recently when they were setting up a 2nd office in my city. I have never seen a router at a cell site, but several in their office.

One of the reasons the cell networks are IPv6 now is they need a contiguous network for all the devices & VoIP, etc.. RFC1918 is not adequate. My phone is IPv6 only and uses 464XLAT to access IPv4 addresses. It has a single IPv4 address, 192.0.0.4, which is reserved for 464XLAT. I don't ever recall seeing anything different. I haven't checked the IPv6 address at different locations. I guess that's something I should do sometime.

BTW, I'm on Rogers.

NollipfSense

@JKnott said in How to block random VPN attempts:

All the servers were located in the office and not at the cell sites. Also, there's a fair bit of cell network underneath the IP layers, to connect the phones to the office. At the cell sites, there are Ethernet switches but not routers, so no local means of providing IP addresses.

Good to know...my T-Mobile (fast 8856w) sure do go through some IP's.

JKnott

@NollipfSense said in How to block random VPN attempts:

Good to know...my T-Mobile (fast 8856w) sure do go through some IP's.

IPv4 or IPv6? As I mentioned, with 464XLAT, you shouldn't see any address change.

NollipfSense

@serbus The use case is a road warrior, user traveling and connects to home via VPN that has a firewall schedule (pfSense does), to open the VPN ports at a certain time...since I, the network admin, known the time, I can safely connect. That way the VPN ports doesn't stay open 24/7 to invite door knockers and unnecessary logs.

NollipfSense

@JKnott said in How to block random VPN attempts:

IPv4 or IPv6? As I mentioned, with 464XLAT, you shouldn't see any address change.

Well, one doesn't know the change occurred since the change is upstream unless one has an app checking what's my IP....so far just IP4...too closed minded (chicken) to know whether IP6 had changed...but, that will change soon.

JKnott

@NollipfSense said in How to block random VPN attempts:

Well, one doesn't know the change occurred since the change is upstream unless one has an app checking what's my IP....so far just IP4...too closed minded (chicken) to know whether IP6 had changed...but, that will change soon.

My phone is IPv6 only, so IPv4 shouldn't even enter into it. However, as I mentioned, should I have to access an IPv4 only site, 464XLAT is used. I can connect OpenVPN over either IPv4 or IPv6.

I was doing some testing recently, with my notebook computer tethered to my cell phone. I was running Wireshark on my computer and Packet Capture on pfSense. I was initially a bit confused when I saw IPv6 on my computer, but IPv4 on pfSense. I then realized 464XLAT caused the difference. I had changed the DNS name for IPv6, to force IPv4.