Jump to content
Not connected, Your IP: 3.144.98.61
FunThomas

internal portscans over VPN connection

Recommended Posts

Hello,
i use eddie vpn and i have some portscans or something similar incoming to my pc.
The scans comes from the IP mentioned in the Forwarded Ports list -> there is "Forwarded To:" and a IPv4 and from this ip i get portscans.

My firewall is reporting requests over localbridge.exe (here IPv6) or from IPv4 adress over svchost.exe, windows error reporting or mousocoreworker.exe but with different ports as source and destionation port as the forwarded port i opened.
Is there a way to block these attacks from outside ?

best regards,
Thomas

Share this post


Link to post
@FunThomas

Hello!
 
Quote

The scans comes from the IP mentioned in the Forwarded Ports list -> there is "Forwarded To:" and a IPv4 and from this ip i get portscans.


That's one of your own addresses. Specifically, it's the private IPv4 address of your machine in the virtual network. Either you interpret something in some incorrect way, or you're reporting yourself scanning yourself. from your own address to the very same address. As an additional note, we remind you that, in our infrastructure, nodes in the same VPN can't communicate with each other.

Kind regards
 

Share this post


Link to post

hello,

i don't know why my windows firewall is reporting the the mentioned forwarded IP at always different port (and not the forwarded) is trying to use maybe svchost.exe or the other mentioned windows services to connect to a not available home IP 192.168.*.* at some different ports. I don't use this destination subnet.
This is a fresh installed win 10 with eddie and about every 15 min i get a new request from another port to some new port or maybe a new home ip which not exists.

best regards,
Thomas

 

Share this post


Link to post

Hello!

At a first glance it sounds like a normal packet forward (which is mandatory to have things working) between the physical network interface and OpenVPN virtual network interface.

svchost.exe is a Windows system process which takes care of hundreds of different things. Again normal and ordinary.

Private subnets in IPv4 can live only inside one of the following blocks:  10.0.0.0/8,. 192.168.0.0/16 and 172.16.0.0/12, so it's perfectly possible that your local network is inside 192.168.0.0/16. Once again, everything seems just fine.

Kind regards
 

Share this post


Link to post

Hello,
i do not understand why i see a incoming request from 10.x.x.x port 64905 or some else port (which is not forwarded) to a local IP 192.168.8.40:7680 where the IP does not exist in my home network and the port was not the forwarded one.

I think if i turn off VPN i will not see requests like this this makes me feel unsecure with using VPN and getting this requests.

best regards

Share this post


Link to post
@FunThomas

We did not change anything at all... and as we explained the requests you mentioned came from your system itself. Anyway we're glad to know that the mentioned problem is not occurring. Enjoy AirVPN!

Kind regards
 

Share this post


Link to post

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
  • Security Check
    Play CAPTCHA Audio
    Refresh Image

×
×
  • Create New...