Blocked website

[AlastairMutch]

TalkTalk has suddently started blocking web access to a number of websites that I use daily. These are all on the same server / IP address. 5.77.55.132

How do I get this block removed and normal service restored. 

The sites are:

https://www.scottishgliding.com

and a number of other sites on the same server.

I can access them OK via another internet provider. 

I have turned off all the security tools for TalkTalk. 

Alastair

[Debbie-TalkTalk]

Hi Alastair

That's great, thank you 🙂

Debbie

[AlastairMutch]

Hi Debbie,

Yes all good and no further problems. The new router arrive so I just returned it without taking it out of the box. 

Regards,

Alastair

[Debbie-TalkTalk]

Hi @AlastairMutch 

How are you getting on? Is everything still working ok?

[Debbie-TalkTalk]

Hi Alastair

Thanks for letting us know 🙂

Apologies, I can't stop the router order now as it's in progress. You could either refuse delivery when it arrives or return the router using the pre paid returns bag, apologies for this.

[AlastairMutch]

Hi Debbie,

If we can cancel the new router that would be fine. I think I have figured it out. 

We've just upgraded the server affected and a new part of the system is a protection program called Fail2Ban.  I think this is treating my access to the server as an attempt to hack it and is banning my IP address for a period of time.  Details here if anyone is interested:

https://docs.plesk.com/en-US/obsidian/administrator-guide/server-administration/protection-against-b...

I'll work with our hosting service to get this resolved but I'm happy I know where the problem is - and nothing to do with TalkTalk.

Thanks for the great support and service. Very impressed. 

Regards,

Alastair

[Debbie-TalkTalk]

Hi Alastair

Thanks for your reply.

The router is on its way, please allow 24-48hrs for this to arrive.

Let us know how the connection compares with this router.

Debbie

[AlastairMutch]

Hi Michelle,

It's my original router which has been working great (well up to now) for several years. 

Yes, if we could try a new one and see if it stops doing it that would be good. 

Regards,

Alastair

[Michelle-TalkTalk]

Hi Alastair,

I'm sorry to hear this. Have we ever sent you a replacement router? If not then I think we should try this to rule this out.

Michelle

[AlastairMutch]

Yes turning off the router for 30 minutes cleared the block.  However I got up this morning and it has re-appeared.  This isn't great and having the router off for an extended period during the day isn't a good solution. 

Something is obviously triggering some protection algorithm somewhere - DOS false trigger ? I'm using quite a lot of different ports on the remote server for various services.

Alastair

[Chris-TalkTalk]

Hi Alastair,

Sorry to hear this has happened again. Please let us know if the 30 minute shutdown resolves the issue (or not)

Chris

[AlastairMutch]

Today at about 2pm it did exactly the same again. At the moment I am completely blocked from accessing that IP address - none of the services on the remote server are accesible - except that ping does seem to get a reply.  

Some sort of data usuage / security algorithm getting it wrong perhaps?

I'll turn on my work-around again for now and try leaving the router off for 30 minutes over night. 

Annoying though. 

Alastair

[Michelle-TalkTalk]

Hi Alastair,

I'm glad to hear this 🙂

Michelle

[Divsec]

Hi @AlastairMutch great  news. 

[AlastairMutch]

Hi Michelle,

No I hadn't tried turning off the router for 30 minutes. I have done this morning but, stupidly, didn't check if the fault was cleared before that. 

It's now working OK again so that's (to me anyway) pretty amazing.  I'm not sure if it was clearing the session or something else but either way thank you.  I've turned off my work-around. 

Regards,

Alastair

[Michelle-TalkTalk]

Hi Alastair,

Can I just confirm, have you also tried powering down the router for a full 30 minutes as this will clear the current session?

Thanks

Michelle

[ferguson]

@AlastairMutch 

An IT expert who hates computers? LOL, you are probably not alone!  🙂

It is an odd one this, let's not jump to any more conclusions before the support team here pick this up and advise further. 

[AlastairMutch]

Ah. I replied to the wrong message - that's why the message ordering has gone weird and confused me.  User error..

Sorry about that. 

A

[AlastairMutch]

Strange. I got notification of a message about DNS but when I logged in here it was gone.  🙂

No I'm not using the TT DNS server. I'm using google's  

The various site names I'm trying to access are being resolved OK. I can ping and see the correct IP appearing and NSLookup gives the correct DNS records. I've also checked that there are no proxies set for the browser access.  

Anyway in full expectation that this will never get fixed except when the faulty bit of equipment is eventually replaced, or the security on my account is fixed, or I change ISP I've put a work-around in place so that traffic to that one IP address for all of our sites route via a proxy server.  

This sort of stuff is why I hate computers 🙂

Thanks for trying to help. 

Alastair

[ferguson]

I am loath to advise an expert like yourself, but are you using TalkTalk DNS servers, or others? I connected up via the link you posted just fine. 

[AlastairMutch]

Full disclosure. I used to work in IT (and other stuff) before retiring.  I look after the gliding club's IT infrastructure and servers. 

A