SSL VPN

[ianmclachlan]

Hi Guys,

Does anyone have a guide/reference for setting up geo-blocking to restrict certain countries?  Multiple IP's from several countries are trying to bruteforce the VPN.  We don't have any VPN users needing access from outside the country.

Many thanks,

IM

[rg2017 · Accepted solution]

It is strange, indeed. It's only been happening for the last couple of days. It doesn't seem to be a brute-force attack. They only try once from each IP address, and the attempts are infrequent.

I created a policy that I placed at the top of the IPv4 policies list. It is setup to block traffic originating from whichever geographic locations I specify.

[ianmclachlan]

These attacks seems to be increasing.  I'm currently geo-blocking by dropping traffic on the IPv4Policy by individual country.  However, it's quite time consuming as I have to lookup the IP's locations and add a block for that country.  Anyone found a way of blocking all countires apart from my own. 

@tomasbonf ... this will probably work in your case as well.

[Ger]

ianmclachlan wrote:

These attacks seems to be increasing.  I'm currently geo-blocking by dropping traffic on the IPv4Policy by individual country.  However, it's quite time consuming as I have to lookup the IP's locations and add a block for that country.  Anyone found a way of blocking all countires apart from my own. 

@tomasbonf ... this will probably work in your case as well.

Hi.. I guess adding your country as an address object and then, using the a policy to just allow inbound connection from your country?

EDIT: Yes, I think that could be the way. I just check my fw inbound rules from ssl.vpn and I can add my country in "source" (First, I add my country as object) I will just wait for an "expert" second opinion before "commit" the change..

[rg2017]

I've been seeing more attempts over the past few days. These connections are trying other user account names in addition to the admin and administrator seen before. I just changed the config to only allow connections from IPs in the US geographical location. This is in SSL-VPN Settings in the GUI.

[badnerone]

Hi to all,

Same problem, appear no a brute force attack, but I suspect that attacks are attempts to discover and use some SSL VPN bugs... Here needs an Fortinet Experts answer.

Thanks

[rg2017]

Does anyone know if it's possible to see a log of attempted connections now that I have the restricted hosts set to the US? I've looked and can't find any event logs that contain those attempts being blocked.

[Ger]

rg2017 wrote:

Does anyone know if it's possible to see a log of attempted connections now that I have the restricted hosts set to the US? I've looked and can't find any event logs that contain those attempts being blocked.

I don't know if this is what you need, but I think you need to have enabled "event logging" in log settings.

Then, events. vpn events, "action" ssl-login-fail.  I have tons of them even with geolocation configured

[Ger]

rg2017 wrote:

I've been seeing more attempts over the past few days. These connections are trying other user account names in addition to the admin and administrator seen before. I just changed the config to only allow connections from IPs in the US geographical location. This is in SSL-VPN Settings in the GUI.

[attachImg]https://forum.fortinet.com/download.axd?file=0;198347&where=message&f=vpn-settings.png[/attachImg]

THIS, thanks.

I just followed https://kb.fortinet.com/kb/documentLink.do?externalID=FD40500 but i still getting ssl logins failed. I don't know if the policy it's ok, basically all from the sd-wan to ssl.root deny, but still getting login attemps.

[nkasiou]

we are facing the same issue. 

We have FortiGate Firewalls installed around the world and all of them are targeted.

the brute force started in Aug18 the attacks are mostly IPs from China. 

the IP is always different and they target different usernames every 2 minutes in a rotation. 

we have tried to increase the block time for 2 unsuccessful logins but that does not trigger.  

Does anyone have a solution for this? as I can see the attack is increasing.

does anyone know if this attack only targets Fortigate firewalls?

[nkasiou · Accepted solution]

Following up. 

We can see that the source IPs are Hacked devices from all over the world. 

if you add the IPs on the browser you can see that they are routers, hotspots, network devices  etc....

so they are redirecting their malicious requests through the hacked devices.

Most of these devices have the default admin password of the provider/brand. I was able to log in to multiple devices. 

the bad thing is that the hacked devices are too many so you cannot just block the IPs. 

Blocking the malicious IPs that are coming in with a script will not help because up until now the requests come from unique IPs.

[ianmclachlan]

Restricting Access in the SSL-VPN settings worked a treat.  Clearly some automated script searching the net for weak/default login creds.  Probably everyone affected uses 10443 as the VPN port and this might correspond to some other service/device that the script is looking or checking for.