Strangers connected to my server without forwarded port

Hi,

On Saturday I was setting up a TS server on my Ubuntu machine and on Sunday I was checking it, if the process is still alive and suddenly I was able to see 4 strangers on my server!

I checked our router-settings immediately: the only ports forwarded were HTTP, HTTPS, Minecraft
Then I started to panic! I tried to reach my server from outside with my phone but I got an error. TS’ port was closed at that time!
After that I started to panic even more and shutdown my server.

Please help me explaining this or I have to purge my server due to a hacking attack :frowning:

How can someone connect to my TS which was just set up, no ports forwarded and for myself not reachable from outside??

Could you please send us your server_0 and server_1 logfile?

It’s not required to forward/open ports if your server has an open firewall.
That’s also what I assume has caused this.

The panic is justified only if you doesn’t have an active firewall running.

Thank you for your fast reply.

I got TS3service running under a ts3 user with no sudo rights and also disabled login when I created this user.
In the home-directory of this user there is a log folder. Do you mean these logs?

I never thought about the firewall because I thought, that when the port is not forwarded to the server, nobody can reach it!
So how could they reach my server when I was not able to reach it?

That’s what we need to figure out.

If you have disabled the OS internal firewall or if the OS doesn’t have an inbuilt firewall this can happen.


Yes I mean the 2 logfiles of the ts3server application.

I put them on Google Drive if that’s allright with you:

https://drive.google.com/drive/folders/1Ivh24W0vveBSlVzcEfvYHWFFGAMTizx1?usp=sharing

Sorry but some of the uploaded files are useless, I uploaded all but server is offline since I think 3 o’clock in the morning.
The client with the out of date ID was myself… don’t know why this happened.

Just as note; you should edit your virtual server > protocol and log clients.
If so they will be logged in the logfiles.

There’s nothing I can see or identify in your logfiles.

The server keeps shutting down.
That’s I guess isn’t your action it happens because you haven’t opened the required ports.


How could you connect to the server if you haven’t opened the ports as you said?

I shut the server down, this was my action.
Sometimes I restart because of other things and last night I tried to restart only TS to see if they reconnect.

Yes, I wondered why I could see nothing. Don’t know why log level isn’t better on default… -.-

I connect to my server without forwareded ports because I am in the same network.

Ah okay.
This means your Ubuntu server is running in your local network, too.

I have expected it to be a virtual/dedicated server outsite your LAN.

To move forward and do some tests I will need your IP address.
If you don’t want to share this in public, just send me private message and I will respond with a TeamSpeak address you can join. I will go on to help you there in your primary language.

I will publish the result later in here.


(edit)

The issue got “solved”.

The router firewall is not working as intended.
And the Ubuntu firewall needed to be reconfigured in order to work.

:kissing_heart:

1 Like

Thank you for your help!

I got something that I want to mention now:
In my router I tried a few things regarding to port-forwarding…
Sometimes it works, sometimes it does not work.
I just deleted the “disabled” TS forwarding rule and it stopped working hahaha
Then I made a new rule for TS -> started working again xD

So the ISP’s modem-router thing is just shit!

1 Like
twitch instagram twitter facebook