What do you do when you get scanned?

leaskovski · 9 Dec 2016 at 15:36

Ok, so I have a single port opened up on my router to allow my OpenVPN setup in. On the router I have the syslog events forwarded on to my syslog server that chucks alerts for when their are incoming connections on that port, thus knowing when I am logging in to OpenVPN via the initial connection, then via a successfully authentication, and if I'm SSH'ing onto the box, then via an alert for that as well.

The first day I setup the alert processing, I got an alert, then it was quiet for a long time until last night when a few alerts came in from someone connecting on the port, but I never got the successful authentication notification, so the connection didn't convert (which is good!).

When I get the alerts, if Im not super busy I always go and whois the IP to find out if its the Chinese or the Russians, and then if I'm super curious, I will do a nmap on them. I'm thinking of maybe automating this with a bash script to email me a report after the event.

So what do other do when this happens? Should I run some other tool to scan the scanner?

Sp00n · 9 Dec 2016 at 15:39

I just use fail2ban if it's a service I want to secure, people and applications are constantly scanning, there is no point looking up each one individually imo.

bledd · 9 Dec 2016 at 15:56

You might get less hits if you use an obscure port number.

IE Don't change the VPN server settings, but on your port forwarding, tell it to forward 44444 to 1194 instead.

Then in your ovpn client file, edit the port number to 44444.

leaskovski · 9 Dec 2016 at 16:08

Yeah, a different port is pretty obvious, bit I kind of like the intrigue of someone sniffing my hole

pc-guy · 9 Dec 2016 at 16:39

until they break your back doors down and rudely stick something hard inside! ;-)

KIA · 9 Dec 2016 at 18:20

leaskovski said:
So what do other do when this happens?

Nothing. It's the nature of the Internet.