4

I got Event ID 20209 in my logs, even though I didn't try to connect. The certificate is still with me and no one else has access to it. Only machine certificate allowed. But event viewer states that:

A connection between the VPN server and the VPN client 92.63.194.91 has been established, but the VPN connection cannot be completed. The most common cause for this is that a firewall or router between the VPN server and the VPN client is not configured to allow Generic Routing Encapsulation (GRE) packets (protocol 47).

Is it a matter to be concerned about?

harrymc
  • 455,459
  • 31
  • 526
  • 924
Bhavya Gupta
  • 447
  • 3
  • 21
  • IKEv2 is considered to be among the fastest and most secure protocols available. Security depends mainly on the strength of the login password. Please add details about this and whether you are using your own VPN (which one) and whether Man-in-the-Middle attacks are possible. Some details about the IKEv2 key would be useful. Brute-force attack would require multiple such events - did you only get one such event? – harrymc Mar 29 '20 at 07:31
  • One possible cause is the client changing their password but not clearing the cached credentials for the connection. – harrymc Mar 29 '20 at 09:19
  • Nope, the key was still with me and not given to client. Man-in the-middle is not possible. The key was self-made with local certificate authority. – Bhavya Gupta Mar 29 '20 at 10:02
  • Questions: (1) Is the server open to the internet? (2) One event or many? Remark: IP `92.63.194.91` was [reported as abusive](https://www.abuseipdb.com/check/92.63.194.91). – harrymc Mar 29 '20 at 10:19
  • Yes, 500, 4500 were open. Many attempts. – Bhavya Gupta Mar 29 '20 at 11:31

1 Answers1

1

You are open to the internet and are being attacked. However, the attack is likely not directed at your VPN server, although the errors you are getting are probably from its firewall.

The Generic Routing Encapsulation (GRE) is defined by Wikipedia as:

Generic Routing Encapsulation (GRE) is a tunneling protocol developed by Cisco Systems that can encapsulate a wide variety of network layer protocols inside virtual point-to-point links or point-to-multipoint links over an Internet Protocol network.

This is a versatile method of passing messages from all sort of other protocols to the recipient. This attack is usually directed at routers with the intent of establishing a tunnel between the victim router and the attacker, that will allow the sniffing of data and more. Not all the possible uses of GRE as attack vector are known even today, since it can carry multiple types of payloads from other protocols than just TCP/IP. GRE as attack payload became popular with the Mirai botnet but was relatively less-known before that.

But to answer the question, although your VPN server is perhaps not being attacked, IKEv2 is considered to be among the fastest and most secure protocols available. Security depends mainly on the strength of the login password.

You may find some in-depth discussions of GRE attacks in the following references:

The first link offers some advice for the mitigation of GRE attacks, although perhaps more related to CISCO routers.

For someone who is not a security expert or doesn't have the services of one, what you can do is ensure that the firmware of your router(s) is well updated. Review also all the settings of the router, with a view to disallowing everything that is not absolutely essential, including GRE if you can. Rebooting the router regularly is also a good idea.

As your IP segment on the internet is being attacked, you should do the same to the firewall of the VPN server or any other device that is exposed to the Ethernet.

harrymc
  • 455,459
  • 31
  • 526
  • 924
  • Sorry@harrymc your answer seems not to be to the point. By the way I got my answer from SERVERFAULT. Thanks for your help. You can check out my development. Issuing `+50` bounty to you :) . The point is even if someone fails to connect, still a connection is established to check credentials. But as soon as certificate is not provided, that error shows up. Please upvote my question, I am blocked to ask any question... – Bhavya Gupta Mar 30 '20 at 06:56