internal portscans over VPN connection

[FunThomas 0]

Hello,
i use eddie vpn and i have some portscans or something similar incoming to my pc.
The scans comes from the IP mentioned in the Forwarded Ports list -> there is "Forwarded To:" and a IPv4 and from this ip i get portscans.

My firewall is reporting requests over localbridge.exe (here IPv6) or from IPv4 adress over svchost.exe, windows error reporting or mousocoreworker.exe but with different ports as source and destionation port as the forwarded port i opened.
Is there a way to block these attacks from outside ?

best regards,
Thomas

[Staff 9972]

@FunThomas

Hello!
 

Quote

The scans comes from the IP mentioned in the Forwarded Ports list -> there is "Forwarded To:" and a IPv4 and from this ip i get portscans.

That's one of your own addresses. Specifically, it's the private IPv4 address of your machine in the virtual network. Either you interpret something in some incorrect way, or you're reporting yourself scanning yourself. from your own address to the very same address. As an additional note, we remind you that, in our infrastructure, nodes in the same VPN can't communicate with each other.

Kind regards
 

[FunThomas 0]

hello,

i don't know why my windows firewall is reporting the the mentioned forwarded IP at always different port (and not the forwarded) is trying to use maybe svchost.exe or the other mentioned windows services to connect to a not available home IP 192.168.*.* at some different ports. I don't use this destination subnet.
This is a fresh installed win 10 with eddie and about every 15 min i get a new request from another port to some new port or maybe a new home ip which not exists.

best regards,
Thomas

 

[Staff 9972]

Hello!

At a first glance it sounds like a normal packet forward (which is mandatory to have things working) between the physical network interface and OpenVPN virtual network interface.

svchost.exe is a Windows system process which takes care of hundreds of different things. Again normal and ordinary.

Private subnets in IPv4 can live only inside one of the following blocks:  10.0.0.0/8,. 192.168.0.0/16 and 172.16.0.0/12, so it's perfectly possible that your local network is inside 192.168.0.0/16. Once again, everything seems just fine.

Kind regards
 

[FunThomas 0]

Hello,
i do not understand why i see a incoming request from 10.x.x.x port 64905 or some else port (which is not forwarded) to a local IP 192.168.8.40:7680 where the IP does not exist in my home network and the port was not the forwarded one.

I think if i turn off VPN i will not see requests like this this makes me feel unsecure with using VPN and getting this requests.

best regards

[FunThomas 0]

i don't know what you changed but the requests stopped 😉 thanx

[Staff 9972]

@FunThomas

We did not change anything at all... and as we explained the requests you mentioned came from your system itself. Anyway we're glad to know that the mentioned problem is not occurring. Enjoy AirVPN!

Kind regards