Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ianmclachlan
New Contributor

SSL VPN

Hi Guys,

 

Does anyone have a guide/reference for setting up geo-blocking to restrict certain countries?  Multiple IP's from several countries are trying to bruteforce the VPN.  We don't have any VPN users needing access from outside the country.

 

Many thanks,

 

IM

 

 

2 Solutions
rg2017
New Contributor III

It is strange, indeed. It's only been happening for the last couple of days. It doesn't seem to be a brute-force attack. They only try once from each IP address, and the attempts are infrequent.

 

I created a policy that I placed at the top of the IPv4 policies list. It is setup to block traffic originating from whichever geographic locations I specify.

View solution in original post

nkasiou
New Contributor

Following up. 

 

We can see that the source IPs are Hacked devices from all over the world. 

if you add the IPs on the browser you can see that they are routers, hotspots, network devices  etc....

so they are redirecting their malicious requests through the hacked devices.

 

Most of these devices have the default admin password of the provider/brand. I was able to log in to multiple devices. 

 

the bad thing is that the hacked devices are too many so you cannot just block the IPs. 

 

Blocking the malicious IPs that are coming in with a script will not help because up until now the requests come from unique IPs.

View solution in original post

21 REPLIES 21
rg2017
New Contributor III

ianmclachlan wrote:

Restricting Access in the SSL-VPN settings worked a treat.  Clearly some automated script searching the net for weak/default login creds.  Probably everyone affected uses 10443 as the VPN port and this might correspond to some other service/device that the script is looking or checking for. 

It's definitely working here as well. I have seen zero unwanted log in attempts since doing this.

rg2017
New Contributor III

nkasiou wrote:

Following up. 

 

We can see that the source IPs are Hacked devices from all over the world. 

if you add the IPs on the browser you can see that they are routers, hotspots, network devices  etc....

so they are redirecting their malicious requests through the hacked devices.

 

Most of these devices have the default admin password of the provider/brand. I was able to log in to multiple devices. 

 

the bad thing is that the hacked devices are too many so you cannot just block the IPs. 

 

Blocking the malicious IPs that are coming in with a script will not help because up until now the requests come from unique IPs.

Great info! Thanks for sharing!

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors