I tried to find my old post but unsuccessfully.
I really have a problem with connections that seem to connect to my VPN Server without seeing them active in the VPN itself but in the firewall filter and in log they are there, what should I do?
Right now I have ip banned them but I can't keep that going.
I also try to make a simple: / ip firewall filter add chain = input src-address = 2.106.208.98 action = drop
But it doesn't work?
Am I exposed to atack?

Regards
Jimmy

TCP connection is just first step of establishing vpn, then the authentication starts.

So it doesn't mean that they can get it, just that "they" are trying.