US VPN Brute Force

Forum|Forum|1 year ago
March 6, 2025
5 replies
1363 views

I've followed some of the most posted protocols for preventing brute force on my vpn interface, biggest was to only allow US based traffic to the interface, but what I've found in the last coupld of years, is that all the open VPN environments in the US are used by threat actors constantly. I'm up to about 3000 failed login attempts in 6 hours time. This is just US based IP's and when I look them up, the bulk of them are associated to open VPN providers IN the US.

I was doing some searching to see if there are geo lists of these open vpn providers that I could import. I've been manually digging up the blocks and doing ASN/Whois lookups to piece it together. I get it down to about 200 / 6 hours, but then in a couple of weeks, shoots back up to the 1K's of hits. Anyone have suggestions? Again, this is US only attacks at this point.

SSL-VPN

Best answer by AEK

You can configure the custom port as show below.

AEK

SuperUser

Move the VPN port to an unknown high port, so scanners can't find it easily.

Also tune the limits like shown below and it will highly mitigate brute force attempts.

config vpn ssl settings
  set login-attempt-limit 2
  set login-block-time 600
end

AEK

cql-user-01Author

Visitor III

No such luck, but thanks. Like I said, I've denied everything but the US, which works, except for all the foreign actors that use the US's VPN network.

AEK

SuperUser

If you move the port to a high unknown port (something like 43210) then I think no one will find you anymore, except those who received the info from you.

AEK

Sign up

Login with SSO

Login to the community

Login with SSO