Getting blocked from one of my servers

easyhostmedia

easyhostmedia

Well-known member
i had a recent strange spate of getting blocked from one of my servers.

what was strange is i would turn my phone on in the morning and i would get all emails received over night, but for a few mornings emails would arrive from certain emails and my phone would say cant connect with server.
i would then turn on my PC and my emails would fail, so would go to servers root access and would not get into server, so on my phone i would disable wifi and use the phones mobile connection and get straight through the server, so would unblock the wifi IP address and all work fine then the same thing would happen the following morning, would understand if i have failed logins, but as PC and connect closed overnight this could not be the case and nothing showing in server logs to indicate any one trying to login overnight. and i noticed each morning my ISP IP was different to the days before.

still no one from server providers to ISP techs could figure out why or how this was happening.
 
Well... If you have the power to unblock yourself - that means it is your system that is blocking you.

You'd need to look in your logs to see what was happening.

If it's cPanel - /var/log/maillog would be where I would look.

If you're running CSF/LFD - look in /var/log/lfd.log as well.
 
MikeDVB said:
Well... If you have the power to unblock yourself - that means it is your system that is blocking you.

You'd need to look in your logs to see what was happening.

If it's cPanel - /var/log/maillog would be where I would look.

If you're running CSF/LFD - look in /var/log/lfd.log as well.
Click to expand...

yes and nothing in any logs to show any issues. as stated i could understand for failed logins, but when my PC is turned off overnight when i am asleep i would not be accessing the servers to get blocked.

it seems to have corrected itself with this issue
 
easyhostmedia said:
yes and nothing in any logs to show any issues. as stated i could understand for failed logins, but when my PC is turned off overnight when i am asleep i would not be accessing the servers to get blocked.

it seems to have corrected itself with this issue
Click to expand...
I've seen strange things - like where my phone was checking email all night via IMAP while plugged in, a cPanel update caused IMAP to be unavailable for a short period, and somehow I got blocked.

It hasn't happened in a long time and when it did - it was in the logs...

That said - very odd. If you want me to give it a look I am happy to so long as you understand I'd be doing it in my free time and I can't make any promises :).
 
Just a thought, why not whitelist your ISP IPs in the CSF, like 193.345.98.* or what ever you ISP may be.

I have my phone to check my email ever 30 mins unless I make it auto check, Well if your are getting multiple emails about the same time, say around 2AM when your server is backing up, updating and your getting those emails your phone may hit the server to many times within a short time so its clocking the ISP ip address in CSF.

You wont find anything in the logs per-say but hopefully it does not keep being a problem.
 
FusedServers said:
Just a thought, why not whitelist your ISP IPs in the CSF, like 193.345.98.* or what ever you ISP may be.

I have my phone to check my email ever 30 mins unless I make it auto check, Well if your are getting multiple emails about the same time, say around 2AM when your server is backing up, updating and your getting those emails your phone may hit the server to many times within a short time so its clocking the ISP ip address in CSF.

You wont find anything in the logs per-say but hopefully it does not keep being a problem.
Click to expand...

does not block my backup servers IP, so this still happens at 3am each morning

my phone and PC are turned off over night, so these are not checking for emails etc.

it was not noticed until i turned my phone on in the morning and my emails from the 1 server not being displayed. (not my main email account, so not a lot of emails anyway)

server techs and SP techs could not find why this was happening, but then it seemed to have sorted itself out and has worked fine since
 
GoldenBeaverHos said:
It would be a good idea to get a static IP address and then whitelist your IP address in CSF or any other firewall.
Click to expand...

The only thing my ISP would provide static IPs unless i move my domestic broadband service to a business broadband service which will jump from £5 a month to £32 a month and then another £10 for a static IP
 
GoldenBeaverHos said:
It would be a good idea to get a static IP address and then whitelist your IP address in CSF or any other firewall.
Click to expand...

Just whitelisting IP is not the solution, OP needs to figure out the cause of the problem ,because if it's blocking you it then it must be even blocking your clients or site visitors, i think it's configuration issue with CSF or cPanel.

From my experience there are few possible causes:

1) may be some mail client is connecting too often or making multiple connections to imap/pop3 and probably the connection times out, sometimes if there are too many simultaneous connections to same imap account, the imap server starts accepting passwords for new connection and it might trigger csf to consider it as a brute force and might block your IP

2) if you have some process that's trying to access some website on your server, then possible some mod_security rule is causing it

I hope it helps
 
rectified said:
Just whitelisting IP is not the solution, OP needs to figure out the cause of the problem ,because if it's blocking you it then it must be even blocking your clients or site visitors, i think it's configuration issue with CSF or cPanel.

From my experience there are few possible causes:

1) may be some mail client is connecting too often or making multiple connections to imap/pop3 and probably the connection times out, sometimes if there are too many simultaneous connections to same imap account, the imap server starts accepting passwords for new connection and it might trigger csf to consider it as a brute force and might block your IP

2) if you have some process that's trying to access some website on your server, then possible some mod_security rule is causing it

I hope it helps
Click to expand...

not a configuration issue, as its the same setting and config as all my other servers.

strange that since i told my ISP about this and them saying cant be them this issue has stopped.
 
You must log in or register to reply here.

Supporters

Back
Top