I went and got myself blocked - help please!

[Dotcoms]

Do the following:-

vi /etc/portsentry/portsentry.conf

Find the following lines:

# 0 = Do not block UDP/TCP scans.
# 1 = Block UDP/TCP scans.
# 2 = Run external command only (KILL_RUN_CMD)

BLOCK_UDP=&0&
BLOCK_TCP=&0&

Make sure the values are &0& else if you ping your box you will be blocked.

Exit and save portsentry.conf

Do:-

/etc/rc.d/init.d/portsentry stop

route del -n xxx.xxx.xxx.xxx (Your IP address)

/etc/rc.d/init.d/portsentry start

Hope that helps

Steve

[Drake]

Please tell... What did you do to get yourself blocked?

...And... what service(s) are you blocked from?

Your IP could usually be being blocked from 2 different places:

/var/portsentry/portsentry.blocked.tcp (and or blocked.udp)

or /etc/hosts.deny

You should first locate those files and see if your IP # is in there.
If so, edit it and take your IP out of there.

Hey.. if you're totally blocked, how are you even gaining telnet or ssh access to the box to even check if you have those files?

If you can get in to shell access, you aren't blocked by your IP.

Another thought: Are you remotely accessing the box from a static IP or from a dial up? Dial ups are usually not static, therefore you get a new IP every time you dial it up.

[qbacca]

Ok, here's the deal -

our server has 4 IP addresses, one in the 209.x.x.x block, and 3 from the 66.x.x.x block.

There was something about the default ipaliases script that caused (I don't know exactly what - my network guy figured this out) all traffic from 66.*.*.* to be ignored.

The fix was to SSH in and do

service network restart

This fixes the problem every time. So, every time we reboot the server, cpanel's ipaliases script runs, and kills traffic from 66.*.*.* - we do the service network restart, and I have access again.

Weird bug? Who knows - I'm just glad I have access again.

Marc