216.218.206.86 in VPN log
 

What's all this then?

Jul 18 03:06:19 13[IKE] 216.218.206.86 is initiating a Main Mode IKE_SAJul 18 14:29:25 06[IKE] 218.75.37.18 is initiating a Main Mode IKE_SAJul 18 14:55:12 10[IKE] 218.75.40.147 is initiating a Main Mode IKE_SAJul 19 03:39:10 09[IKE] 216.218.206.126 is initiating a Main Mode IKE_SAJul 20 03:14:32 02[IKE] 216.218.206.78 is initiating a Main Mode IKE_SAJul 21 04:35:26 02[IKE] 216.218.206.122 is initiating a Main Mode IKE_SAJul 22 02:24:01 06[IKE] 216.218.206.102 is initiating a Main Mode IKE_SAJul 23 03:17:03 10[IKE] 216.218.206.90 is initiating a Main Mode IKE_SA

I spotted this in my IPSec VPN log. What are the IP addresses 218: ** 216: ** ? Is this something malevolent. My general router log doesn't show a successful attempt to connect to my VPN, but is this an attempt?

Re: 216.218.206.86 in VPN log
 

What IP is the VPN using?

Re: 216.218.206.86 in VPN log
 

A Whois lookup of the first IP reveals this.

https://www.abuseipdb.com/check/216.218.206.86

Re: 216.218.206.86 in VPN log
 

My VPN is using my WAN IP but I also have DDNS configured.

---------- Post added at 08:43 ---------- Previous post was at 08:32 ----------

Thanks for the info.

So we are talking about an illegal hack attempt? I assume malevolence, but is it dangerous? If so, what can the attack achieve for the hackers? Given that this is a common and potentially widespread issue the attack is probably automated.

My security keys are strong, but I guess I ought to change them more often.

It's popped up again this morning, but this time with a variation in source IP.

Jul 24 01:41:02 05[IKE] 216.218.206.98 is initiating a Main Mode IKE_SA

Re: 216.218.206.86 in VPN log
 

That last address is the same owner as the previous.

Could this simply be that someone/thing has spotted the service on your IP and is now probing and trying to force a connection?

Re: 216.218.206.86 in VPN log
 

I tend to agree. Automated port sniffers are widespread.

I suggest you give Shield's Up test a go.

https://www.grc.com/x/ne.dll?bh0bkyd2

Re: 216.218.206.86 in VPN log
 

OK I tried your link, first of all without, VPN. My unique "machine name" was revealed. However, when I tried a VPN location in the Netherlands, it wasn't revealed.

I then proceeded to the all-important test without VPN. Here I got "THE EQUIPMENT AT THE TARGET IP ADDRESS DID NOT RESPOND TO OUR UPnP PROBES!"

That is good news, especially considering I have UPnP enabled on my ASUS.

I was running uTorrent at the time, well known for letting outside servers know your local ip address, but that is behind a proxy server.

Would I be right in saying that I am pretty secure? I am visible to hacker scanners, because my WAN IP is easily found, but I am impenetrable with or without VPN. Naturally, I have my router firewall enabled, also DoS protection. Ping response is turned on.

Re: 216.218.206.86 in VPN log
 

Sounds like you'll be OK.

Re: 216.218.206.86 in VPN log
 

Does that shields up test still stand up to todays security? its years old.

Re: 216.218.206.86 in VPN log
 

Yes.