SSL VPN

[ianmclachlan]

Hi Guys,

Does anyone have a guide/reference for setting up geo-blocking to restrict certain countries?  Multiple IP's from several countries are trying to bruteforce the VPN.  We don't have any VPN users needing access from outside the country.

Many thanks,

IM

[rg2017 · Accepted solution]

It is strange, indeed. It's only been happening for the last couple of days. It doesn't seem to be a brute-force attack. They only try once from each IP address, and the attempts are infrequent.

I created a policy that I placed at the top of the IPv4 policies list. It is setup to block traffic originating from whichever geographic locations I specify.

[rg2017]

ianmclachlan wrote:

Restricting Access in the SSL-VPN settings worked a treat.  Clearly some automated script searching the net for weak/default login creds.  Probably everyone affected uses 10443 as the VPN port and this might correspond to some other service/device that the script is looking or checking for. 

It's definitely working here as well. I have seen zero unwanted log in attempts since doing this.

[rg2017]

nkasiou wrote:

Following up. 

We can see that the source IPs are Hacked devices from all over the world. 

if you add the IPs on the browser you can see that they are routers, hotspots, network devices  etc....

so they are redirecting their malicious requests through the hacked devices.

Most of these devices have the default admin password of the provider/brand. I was able to log in to multiple devices. 

the bad thing is that the hacked devices are too many so you cannot just block the IPs. 

Blocking the malicious IPs that are coming in with a script will not help because up until now the requests come from unique IPs.

Great info! Thanks for sharing!