I was just looking at system logs, and found a very interesting entry:

Feb  6 16:56:34 fubegra kernel: VNC_PROBE IN=eth0 OUT= MAC=fe:fd:40:05:35:17:00:02:fc:64:d8:af:08:00 SRC=10.0.0.26 DST=64.5.53.23 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=0 PROTO=TCP SPT=3446 DPT=5900 WINDOW=0 RES=0x00 RST URGP=0

Note the source address, 10.0.0.26 - how did an RFC1918 address make it here?

_________________
Bus error (passengers dumped)

Interesting. It's not from another Linode, since we filter at that level -- only traffic from that Linode's IP & MAC address are allowed out.

The only thing that comes to mind is that this is from a machine at the datacenter. I'll look into this.

Thanks,
-Chris

A number of reasons, but closer examination shows that this was a TCP packet sent to port 5900. That may be the VNC (virtual network connection) port.

The only real valid reason for a VPN address as the source of a TCP packet may be DoS, or something equally sinister.. although port scanning would be hard because the recipient needs a response and a fake source IP doesn't give the scanner somewhere the responses can be delivered to.

Most iptables firewall set ups would be configured to reject any incoming packets to/from VPN addresses.