Bad Protocol version Identification login failure, where are they coming from.

[Matthew Seymour]

This is the security output my question relates too.

freenas.[redacted].[redacted] login failures:
[date] [time] freenas sshd[50671]: Bad protocol version identification 'GET http://www.baidu.com/ HTTP/1.1' from 183.60.48.25

-- End of security output --

I am running the latest stable version of 9 that I updated to yesterday and continue to get these security messages.

I have previously when being a newbie had for a brief period SSH open although on a non standard port with Root logins enabled. I then turned off root logins and set up ssh keys since then I turned off port forwarding al together for SSH and set up OpenVPN in a jail instead. Over the past month or two I have been regularly seeing this (I should have done something about it sooner)

As a test I have turned off all port forwardings on my router and this message continues to appear. The IP 183.60.48.25 is from china but i have no idea how it's hitting my server as all port forwardings are turned off.

Whois output is from chine so certainly looks dodgy. But equally looks like a get request reaching my freenas SSH port but have no Idea how?

Anyone got any idea how screwed I might be or how it may be getting through?

Show : Whois of 183.60.48.25

% [whois.apnic.net]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html

% Information related to '183.0.0.0 - 183.63.255.255'

inetnum: 183.0.0.0 - 183.63.255.255
netname: CHINANET-GD
descr: CHINANET Guangdong province network
descr: Data Communication Division
descr: China Telecom
country: CN
admin-c: IC83-AP
tech-c: IC83-AP
status: ALLOCATED PORTABLE
remarks: service provider
remarks: -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
remarks: To report network abuse, please contact the IRT
remarks: For troubleshooting, please contact tech-c and admin-c
remarks: For assistance, please contact the APNIC Helpdesk
remarks: -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
mnt-by: APNIC-HM
mnt-lower: MAINT-CHINANET-GD
source: APNIC
mnt-irt: IRT-CHINANET-CN
changed: hm-changed@apnic.net 20091009

irt: IRT-CHINANET-CN
address: No.31 ,jingrong street,beijing
address: 100032
e-mail: anti-spam@ns.chinanet.cn.net
abuse-mailbox: anti-spam@ns.chinanet.cn.net
admin-c: CH93-AP
tech-c: CH93-AP
auth: # Filtered
mnt-by: MAINT-CHINANET
changed: anti-spam@ns.chinanet.cn.net 20101115
source: APNIC

person: IPMASTER CHINANET-GD
nic-hdl: IC83-AP
e-mail: gdnoc_HLWI@189.cn
address: NO.18,RO. ZHONGSHANER,YUEXIU DISTRIC,GUANGZHOU
phone: +86-20-87189274
fax-no: +86-20-87189274
country: CN
changed: ipadm@189.cn 20110418
changed: zhengzm@gsta.com 20140922
mnt-by: MAINT-CHINANET-GD
remarks: IPMASTER is not for spam complaint,please send spam complaint to abuse_gdnoc@189.cn
abuse-mailbox: antispam_gdnoc@189.cn
source: APNIC

% This query was served by the APNIC Whois Service version 1.69.1-APNICv1r0 (UNDEFINED)

 

[dlavigne]

Something is wrong in your network. Perhaps a misconfigured firewall or another system with a virus.

 

[Matthew Seymour]

A misconfigured firewall I could understand. Though it is a brand new out of the box Virgin Superhub 2 which i have reset to defaults.
Another system with a Virus a lot less likely as IT continued to happen while I was away and all other devices in the house were off? Also why would freenas be reporting an external IP if it were coming internally? Any way this could be showing this way.