Hi Tim, > > sudo -i ss -p dst 66.39.101.110 > > This did not return anything
You need to run it when Wireshark shows traffic of interest, giving the relevant remote IP address. > Is this the expected actions of a Private VPN?? All VPNs are private. :-) It depends what your VPN aims to do and how it does it. Perhaps sending traffic to port 80 of a variety of remote IP addresses is intended to squeeze through any local restrictions. Port 80 is ‘normal’ being HTTP, though hopefully most traffic is HTTP over TLS, port 443, these days. Having multiple IP addresses might be load balancing at the other end or trying to stop simple IP-address blocking. Though the ones you initially complained about were all in a /24 so easy to block as 256 in one go. -- Cheers, Ralph. -- Next meeting: Online, Jitsi, Tuesday, 2024-01-02 20:00 Check to whom you are replying Meetings, mailing list, IRC, ... http://dorset.lug.org.uk New thread, don't hijack: mailto:dorset@mailman.lug.org.uk
