CSF problem

Discussion in 'Security' started by Tearabite, Jul 30, 2009.

0
  1. #1
    I had blocked a CIDR range (added to csf.deny) and decided to unblock it later (removed from csf.deny and restarted CSF via WHM GUI) due to complaints from legitimate visitors.

    The problem is that IP's (at least one) is still being blocked by CSF. The IP is not anywhere in csf.deny, yet as long as CSF is running, they cannot access the site.

    Any ideas on why it's still blocked or how to troubleshoot it? i posted the problem in the CSF support forums also, but i tend to get faster answers here..
     
    Tearabite, Jul 30, 2009 IP
  2. SecureCP

    SecureCP Guest

    Messages:
    226
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    0
    #2
    Hey! If it's not in csf.deny, have you tested it in iptables?

    iptables -D INPUT -s <IP ADDRESS HERE> -j DROP

    Also, if you have certain blacklists being used in csf settings it is possible that he is on one of them. If this doesn't help, respond and I can provide further input.

    Hope this helps
     
    SecureCP, Aug 5, 2009 IP
  3. justdoit1

    justdoit1 Peon

    Messages:
    100
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    0
    #3
    You can do:

    1. Add ip to whitelists - csf.allow

    /usr/sbin/csf -a 203.30.44.22

    2. Search your blocked IPs

    /usr/sbin/csf -g 203.30.44.22

    If found, do:

     
    justdoit1, Aug 5, 2009 IP
  4. RHS-Chris

    RHS-Chris Well-Known Member

    Messages:
    1,007
    Likes Received:
    35
    Best Answers:
    10
    Trophy Points:
    150
    #4
    Run :

    iptables -L

    From the command line, see if it is still being listed.
     
    RHS-Chris, Aug 5, 2009 IP
  5. Tearabite

    Tearabite Prominent Member

    Messages:
    4,629
    Likes Received:
    429
    Best Answers:
    0
    Trophy Points:
    300
    #5
    Thanks for the tips guys..
    I found that it wasnt the IP of the person that was being blocked, but rather their DNS server was blocked. Since their DNS resides in a country that i do not wish to access my server (blocked via CIDR), i had them use OpenDNS, and now they connect with no problems..
     
    Tearabite, Aug 5, 2009 IP