1

I am using a commercial paid licence to a VPN provider, which I use on two boxes, a FreeBSD, and a Linux BackBox.

When connected to this proxy, my interface receives a public IP from the VPN provider.

My home router has no open ports exposed to the Internet at all (I have tested all 65 thousands ports with Nmap, coming from a different IP). It is also not configured to do any port-forwarding, and I have not enabled DMZ.

Looking at my /var/log/auth.log I noticed IPs from the public domain trying to brute-force my SSH. This only happens when connected to the VPN.

How is it possible that external IPs are reaching my NAT'ed boxes? My only explanation is that they are coming through my VPN connection, but if that's the case, why are these IPs not on the same subnet as that of my proxy provider?

Ideally I would like to be able to investigate this further myself; if anyone has any tips on how I could do some further analysis/forensics, or provide further reading, I would be very grateful.

I have pasted below some snippets of my /var/log/auth.log, and the offending IPs to show how they are not on the same subnet (from the logs none seem to have managed to connect, since I have SSH disabled for user root).


/var/log/auth.log

Mar 15 11:33:18 MyBox sshd[19993]: Invalid user curis from 101.254.141.27
Mar 15 11:33:18 MyBox sshd[19993]: input_userauth_request: invalid user curis [preauth]
Mar 15 11:33:18 MyBox sshd[19993]: pam_unix(sshd:auth): check pass; user unknown
Mar 15 11:33:18 MyBox sshd[19993]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.254.141.27 
Mar 15 11:33:21 MyBox sshd[19993]: Failed password for invalid user curis from 101.254.141.27 port 9038 ssh2
Mar 15 11:33:21 MyBox sshd[19993]: Received disconnect from 101.254.141.27: 11: Bye Bye [preauth]
Mar 15 11:33:24 MyBox sshd[19995]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.254.141.27  user=root
Mar 15 11:33:26 MyBox sshd[19995]: Failed password for root from 101.254.141.27 port 10549 ssh2
Mar 15 11:33:27 MyBox sshd[19995]: Received disconnect from 101.254.141.27: 11: Bye Bye [preauth]

...

Mar 17 19:13:38 MyBox sshd[4369]: reverse mapping checking getaddrinfo for 12.145.195.113.adsl-pool.jx.chinaunicom.com [113.195.145.12] failed - POSSIBLE BREAK-IN ATTEMPT!
Mar 17 19:13:38 MyBox sshd[4369]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.195.145.12  user=root
Mar 17 19:13:40 MyBox sshd[4369]: Failed password for root from 113.195.145.12 port 38767 ssh2
Mar 17 19:13:55 MyBox sshd[4369]: message repeated 5 times: [ Failed password for root from 113.195.145.12 port 38767 ssh2]
Mar 17 19:13:55 MyBox sshd[4369]: error: maximum authentication attempts exceeded for root from 113.195.145.12 port 38767 ssh2 [preauth]
Mar 17 19:13:55 MyBox sshd[4369]: Disconnecting: Too many authentication failures for root [preauth]
Mar 17 19:13:55 MyBox sshd[4369]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.195.145.12  user=root
Mar 17 19:13:55 MyBox sshd[4369]: PAM service(sshd) ignoring max retries; 6 > 3

Some of the Offending IPs

125.64.93.78
125.212.232.112
40.117.40.125
202.83.25.95
185.110.132.54
50.56.29.14
73.240.201.33
78.22.85.130
91.64.44.228
  • 2
    You answered your own question. I quote; my interface receives a public IP from the VPN provider – Ben Voigt Mar 18 '16 at 15:46
  • 1
    That question title sounds like hacker scenario from NCIS. LOL – AstroDan Mar 18 '16 at 17:23
2

Although I don't know the exact configuration of your device and network I can suggest a scenario that matches what you're seeing.

On your local lan you have a network adapter (let's say eth0) which has an internal non-routable IP address which is behind a NAT interface and firewall, so can't be directly contacted.

When you connect to your VPN it'll bring up another network interface (e.g. tap0) which creates an encrypted tunnel out of your network to your VPN provider. At that point it's entirely possible that the IP address you get from your VPN provider is essentially a publicly routable one, which isn't protected by your home firewall as the tunnel bypasses this.

So if your network services (e.g. SSHD) are configured to bind to all network interfaces on your system (a pretty common configuration) when you bring up the VPN interface they'll bind to that too, then if it gets a publicly routable address they'll be "exposed" to the Internet.

You can check this by doing something like ifconfig to get a list of interfaces and IP addresss and then sudo netstat -tunap which should show what interfaces your network services are bound to.

If you see [your_vpn_address:22] or [0.0.0.0:22] then that would explain what you're seeing.

  • You beat me to a post just like this one :P – Thomas Ward Mar 18 '16 at 17:47
  • @Rоry McCune - that is a brilliant explanation, and all I needed: thank you; +1, and accepted. – user82100 Mar 18 '16 at 18:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy