ovpn connection established? Is this an attack?

RouterOS General
1

Hi to all.
I see this one entry in the log:

ovpn,info TCP connection established from 5.39.218.16

It is about a router, pppoe connected, i’m trying to configure it as a vpn server. It lives in my work place.

These are the firewall filters:

/ip firewall filter
add action=accept chain=input comment=vpn disabled=yes dst-port=1194 protocol=tcp
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=winbox dst-port=8291 protocol=tcp
add action=accept chain=input comment="defconf: accept established,related" connection-state=established,related
add action=drop chain=input comment="defconf: drop all from WAN" in-interface=pppoe-out1
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related" connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in
    pppoe-out1

RouterOS 6.42.1, firm as well.

Should I worry?

2

A similar topic popped here very recently - this message only means that a tcp connection has been established to the port at which ovpn listens as an attacker tried to connect, but if it is not followed by another mesage notifying you about successful login, there is not much to worry about.

3

Thank you for the direct reply, sindy.
I will enable again rule #1 and keep trying.
Have a nice month!

4

Be aware that the OpenVPN daemon in RouterOS is a custom Mikrotik version and given their history of other NIH-daemons, it may have remotely exploitable security holes. It is not the official open source OpenVPN daemon which has had rigorous security testing, so I would advise against exposing it to the internet if possible, and definitely not on the default port.

5

I appreciate your recommendations, thank you.

All I have in mind is not to open any other ports, as a security measure.