All Traffic Seen as Gateway IP by cphulk

[NetBlues]

Hello,

After investigating some of your run-of-the-mill cphulk blocks, I realized the reason my whitelist isn't working is that cphulk is seeing all traffic as the gateway IP (10.0.0.1) and brute forcing bots are getting that IP temp banned. Clearly I've taken a wrong turn somewhere in configuration if cphulk is seeing everyone as the gateway's IP. Could anyone lend any insight?

I've checked /scripts/cpanel/cpnat and it looks correct as "10.0.0.3 {correct ext IP}".
I've run /scripts/build_cpnat and see the same with "info [build_cpnat] 10.0.0.3 => {correct ext IP}".

See attachment for example of gateway IP showing in cphulk.

 

[cPanelLauren]

This sounds more like a misconfiguration of the NAT routing on the system than anything else.
Can you please open a ticket using the link in my signature? Once open please reply with the Ticket ID here so that we can update this thread with the resolution once the ticket is resolved.


Thanks!