HELP - I have a hacker trying to use SPECIFIC users to get into my VPN service

[AndrewBytes]

The pattern is they try nonsense users such as "cisco" and I block their IP they come from, but they always come back. I am getting frequent attempts with various other users, but they seem to come back within an hour of me blocking their IPs.

I need a rule that immediately blocks the user, potentially one that could add to a dynamic IP list discouraging return visits, BUT I'd be HAPPY if the user tries with "cisco" is rejected and the connection dropped. My Policy contains the users, but I'm afraid the timing is off since this isn't a "Connection" policy, but a reaction policy. 

[MNoble]

Welcome to the club. 2FA and limiting login by geographic location is the only thing you can do, I believe. 

There's nothing like Fail2ban that will do what you're wanting.

[TomYoung]

Hello @AndrewBytes ,

I have found that disabling the portal login page (under the General tab) has removed 99% of those attempts.  You can re-enable it temporarily if someone needs to download the client.

Thanks,

Tom

[AndrewBytes]

---

@TomYoung wrote:

Hello @AndrewBytes ,

I have found that disabling the portal login page (under the General tab) has removed 99% of those attempts.  You can re-enable it temporarily if someone needs to download the client.

Thanks,

Tom

---

I know I'm asking a dumb question, but this absolutely won't block the VPN client we have coming in?

I am getting "scanned" a lot - I wanna get rid of those guys too - they make me grumpy!

[TomYoung]

Hi @AndrewBytes ,

Correct.  My portal login page is disabled, and GP works fine.

The bots irritate me, too, or they did.  😀

Thanks,

Tom