New Member

Solved

SSL VPN

Forum|Forum|4 years ago
August 19, 2021
5 replies
33310 views

Hi Guys,

Does anyone have a guide/reference for setting up geo-blocking to restrict certain countries? Multiple IP's from several countries are trying to bruteforce the VPN. We don't have any VPN users needing access from outside the country.

Many thanks,

IM

Best answer by nkasiou

Following up.

We can see that the source IPs are Hacked devices from all over the world.

if you add the IPs on the browser you can see that they are routers, hotspots, network devices etc....

so they are redirecting their malicious requests through the hacked devices.

Most of these devices have the default admin password of the provider/brand. I was able to log in to multiple devices.

the bad thing is that the hacked devices are too many so you cannot just block the IPs.

Blocking the malicious IPs that are coming in with a script will not help because up until now the requests come from unique IPs.

rg2017

Explorer II

Hello. You can create an address from Policy and Objects and specify a type of Geography. I'm seeing attempts in the past few days of someone trying to connect to VPN as "administrator" which isn't a valid user. They are coming from other countries. I've added geographical locations to a block policy, but the lists Fortinet provides don't appear to be complete as connections from the companies specified aren't blocked.

ianmclachlanAuthor

New Member

Strange, I'm getting the same attempts to login as "administrator" on two seperate sites on two different Fortinet's, hence my question.

I tried to set the source on "SSL-VPN Interface to LAN" to my country only. But that blocked everyones access to systems/IP's on the LAN for some reason.

@rg2017 ... where are you applying the geo policy?

ihaqueit

New Member

Please check this.

Using the Geo IP block list (fortinet.com)

Ger

New Member

Hi, I'm having the same issue, mostly from india and malaysia. At first I tried to add the source ip as an address and the add those IP's to an address group, but I think this is not the best solution, I just create an user in this site to see if I can find information about this.

I don't know if add an address range to exlcude those IP's will work.. looking for more information about this.

I read that you can add those ip to quarantine, but after a reboot of the unit this will get lost.

tomasbond

New Member

My fortigate VPN SSL is being brute force too. Is it possible to set up and IPS profile to block this from happening? Im having a random user login from two random IPs every 5 minutes. Most IPs come from china, but not all. Its a botnet knocking on my front door. What can i do to protect myself?

PD: reading some other posts, where just administrator and admin are the users being used. in my case administrator was used but not the only. mosly common username like "sales, marketing, john, etc".

ianmclachlanAuthor

New Member

These attacks seems to be increasing. I'm currently geo-blocking by dropping traffic on the IPv4Policy by individual country. However, it's quite time consuming as I have to lookup the IP's locations and add a block for that country. Anyone found a way of blocking all countires apart from my own.

@tomasbonf ... this will probably work in your case as well.

Ger

New Member

ianmclachlan wrote:
These attacks seems to be increasing. I'm currently geo-blocking by dropping traffic on the IPv4Policy by individual country. However, it's quite time consuming as I have to lookup the IP's locations and add a block for that country. Anyone found a way of blocking all countires apart from my own.

@tomasbonf ... this will probably work in your case as well.

Hi.. I guess adding your country as an address object and then, using the a policy to just allow inbound connection from your country?

EDIT: Yes, I think that could be the way. I just check my fw inbound rules from ssl.vpn and I can add my country in "source" (First, I add my country as object) I will just wait for an "expert" second opinion before "commit" the change..

nkasiou

New Member

we are facing the same issue.

We have FortiGate Firewalls installed around the world and all of them are targeted.

the brute force started in Aug18 the attacks are mostly IPs from China.

the IP is always different and they target different usernames every 2 minutes in a rotation.

we have tried to increase the block time for 2 unsuccessful logins but that does not trigger.

Does anyone have a solution for this? as I can see the attack is increasing.

does anyone know if this attack only targets Fortigate firewalls?

nkasiouAnswer

New Member

Following up.

We can see that the source IPs are Hacked devices from all over the world.

if you add the IPs on the browser you can see that they are routers, hotspots, network devices etc....

so they are redirecting their malicious requests through the hacked devices.

Most of these devices have the default admin password of the provider/brand. I was able to log in to multiple devices.

the bad thing is that the hacked devices are too many so you cannot just block the IPs.

Blocking the malicious IPs that are coming in with a script will not help because up until now the requests come from unique IPs.

ianmclachlanAuthor

New Member

Restricting Access in the SSL-VPN settings worked a treat. Clearly some automated script searching the net for weak/default login creds. Probably everyone affected uses 10443 as the VPN port and this might correspond to some other service/device that the script is looking or checking for.

rg2017

Explorer II

ianmclachlan wrote:
Restricting Access in the SSL-VPN settings worked a treat. Clearly some automated script searching the net for weak/default login creds. Probably everyone affected uses 10443 as the VPN port and this might correspond to some other service/device that the script is looking or checking for.

It's definitely working here as well. I have seen zero unwanted log in attempts since doing this.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded