[Question] Port 12103?

[5o52xwmftthyuq2gmdy6 0]

I'm using the set of IP's in denyip.com's "china" block to set up a block of all China IPs.  I don't have any business there, and the vast majority of the hack attempts through my forwarded ports come from there.

That said, as soon as I did it I see my 'country drop' log messages (from iptables) referring to port 12103, like below (personal info redacted)
 

Nov 13 22:04:08 <machine-name> kernel: [1907343.892570] [cn Country Drop] IN=tun0 OUT= MAC= SRC=36.102.210.52 DST=<RFC 1918 IP> LEN=143 TOS=0x00 PREC=0x00 TTL=100 ID=1851 PROTO=UDP SPT=8364 DPT=12103 LEN=123

I can't find any info on this port, and wondered if this was something the AirVPN was using?

 

[Staff 10018]

Hello!

We don't, and anyway even if some service of ours listened to that port of our VPN servers exit-IP address, we would of course not forward packets to VPN nodes (!), if the customer did not require such thing. In this case that's what you did (you remotely forwarded inbound port 12103) so what you see is perfectly normal.

Kind regards