1. RealVNC Help Center
  2. Community
  3. VNC Connect (Viewer, Server, Portal, Accounts)

user.log is full of mysterious Connections/Disconnections

Avatar
Carsten
Follow

Hi,

the user.log on my Linux vncserver which btw runs perfect, is full of entries from uncounted IP addresses from the internet.

I already limited the the IP4 connections to my local network 192.168.0.0/16.

Here is a dump of the file

Jul  8 21:53:39 MMI vncserver-x11[394,root]: Connections: connected: 172.233.57.39::59430 (TCP)
Jul  8 21:53:39 MMI vncserver-x11[394,root]: Connections: disconnected: 172.233.57.39::59430 (TCP) ([EndOfStream] Disconnection by client)
Jul  8 21:53:39 MMI vncserver-x11[394,root]: Connections: connected: 172.233.57.39::59528 (TCP)
Jul  8 21:53:39 MMI vncserver-x11[394,root]: Connections: connected: 172.233.57.39::59540 (TCP)
Jul  8 21:53:39 MMI vncserver-x11[394,root]: Connections: connected: 172.233.57.39::59522 (TCP)
Jul  8 21:53:39 MMI vncserver-x11[394,root]: Connections: connected: 172.233.57.39::59526 (TCP)
Jul  8 21:53:39 MMI vncserver-x11[394,root]: Connections: disconnected: 172.233.57.39::59540 (TCP) ([ProtocolError] RFB protocol error: reading version failed: not an RFB client?)
Jul  8 21:53:39 MMI vncserver-x11[394,root]: Connections: connected: 172.233.57.39::59578 (TCP)
Jul  8 21:53:39 MMI vncserver-x11[394,root]: Connections: disconnected: 172.233.57.39::59578 (TCP) ([EndOfStream] Disconnection by client)
Jul  8 21:53:39 MMI vncserver-x11[394,root]: Connections: disconnected: 172.233.57.39::59522 (TCP) ([EndOfStream] Disconnection by client)
Jul  8 21:53:39 MMI vncserver-x11[394,root]: Connections: disconnected: 172.233.57.39::59528 (TCP) ([EndOfStream] Disconnection by client)
Jul  8 21:53:40 MMI vncserver-x11[394,root]: Connections: disconnected: 172.233.57.39::59526 (TCP) ([EndOfStream] Disconnection by client)
Jul  8 21:53:40 MMI vncserver-x11[394,root]: Connections: connected: 172.233.57.39::60718 (TCP)
Jul  8 21:53:40 MMI vncserver-x11[394,root]: Connections: connected: 172.233.57.39::60830 (TCP)
Jul  8 21:53:40 MMI vncserver-x11[394,root]: Connections: disconnected: 172.233.57.39::60830 (TCP) ([ProtocolError] RFB protocol error: reading version failed: not an RFB client?)
Jul  8 21:53:40 MMI vncserver-x11[394,root]: Connections: connected: 172.233.57.39::60914 (TCP)
Jul  8 21:53:40 MMI vncserver-x11[394,root]: Connections: disconnected: 172.233.57.39::60914 (TCP) ([ProtocolError] RFB protocol error: reading version failed: not an RFB client?)
Jul  8 21:53:40 MMI vncserver-x11[394,root]: Connections: disconnected: 172.233.57.39::60718 (TCP) ([EndOfStream] Disconnection by client)
Jul  8 22:29:41 MMI vncserver-x11[394,root]: Connections: connected: 91.92.251.110::65533 (TCP)
Jul  8 22:29:41 MMI vncserver-x11[394,root]: Connections: disconnected: 91.92.251.110::65533 (TCP) ([System-104] read: Connection reset by peer (104))
Jul  8 23:29:44 MMI vncserver-x11[394,root]: Connections: connected: 91.92.251.110::65345 (TCP)
Jul  8 23:29:44 MMI vncserver-x11[394,root]: Connections: disconnected: 91.92.251.110::65345 (TCP) ([System-104] read: Connection reset by peer (104))
Jul  8 23:42:08 MMI vncserver-x11[394,root]: Connections: connected: 57.152.78.250::36254 (TCP)
Jul  8 23:42:08 MMI vncserver-x11[394,root]: Connections: disconnected: 57.152.78.250::36254 (TCP) ([ProtocolError] RFB protocol error: reading version failed: not an RFB client?)
Jul  9 00:29:22 MMI vncserver-x11[394,root]: Connections: connected: 91.92.251.110::65409 (TCP)
Jul  9 00:29:22 MMI vncserver-x11[394,root]: Connections: disconnected: 91.92.251.110::65409 (TCP) ([System-104] read: Connection reset by peer (104))
Jul  9 01:28:02 MMI vncserver-x11[394,root]: Connections: connected: 91.92.251.110::65280 (TCP)
Jul  9 01:28:02 MMI vncserver-x11[394,root]: Connections: disconnected: 91.92.251.110::65280 (TCP) ([System-104] read: Connection reset by peer (104))

 

Is there a way to block those connections facing the internet?

Thanks

Carsten

0

Comments

2 comments
Sort by Date Votes
  • Avatar
    Jack

    It looks like you have your Server port forwarded from the Internet - you should disable that. If you need to access it remotely, use RealVNC's cloud connections.

    0
    Comment actions Permalink
  • Avatar
    Carsten

    Hi Jack,

    yes, you're right. Thank you for addressing this. I will check these settings.

    Best

    Carsten

    0
    Comment actions Permalink

Please sign in to leave a comment.

Didn't find what you were looking for?

New post