The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Block Connection refused errors

Discussion in 'Security' started by nunoleite, Oct 13, 2014.

  1. nunoleite

    nunoleite Active Member

    Joined:
    Jun 4, 2007
    Messages:
    37
    Likes Received:
    0
    Trophy Points:
    6
    Hi!

    This morning i received this connections to my server.... lots of this.... That server was super slow.

    Code:
    [Mon Oct 13 10:03:15 2014] [error] [client xx.xx.xx.xx] * connect to xx.xx.xx.xx port 80 failed: Connection refused
    [Mon Oct 13 10:03:15 2014] [error] [client xx.xx.xx.xx] * Failed to connect to randomhack.wf port 80: Connection refused
    [Mon Oct 13 10:03:15 2014] [error] [client xx.xx.xx.xx] * Closing connection 0
    [Mon Oct 13 10:03:15 2014] [error] [client xx.xx.xx.xx] * connect to xx.xx.xx.xx port 80 failed: Connection refused
    [Mon Oct 13 10:03:15 2014] [error] [client xx.xx.xx.xx] * Failed to connect to randomhack.wf port 80: Connection refused
    [Mon Oct 13 10:03:15 2014] [error] [client xx.xx.xx.xx] * Closing connection 0
    All from the same ip, but not all to the same destination.
    I investigated and found that was a script being used to make connections outside the server.

    I had to block the ip manually to stop this.

    Is there any option i can activate in the firewall to block this kind of errors if for example this happens 15 times in 5 minutes or something like this...?

    Thanks
    Nuno Leite
     
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,723
    Likes Received:
    660
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
  3. nunoleite

    nunoleite Active Member

    Joined:
    Jun 4, 2007
    Messages:
    37
    Likes Received:
    0
    Trophy Points:
    6
    Hi!

    I'm using CSF.

    I already configured the LF_APACHE_404 = 100 cause i have a lot of "File does not exist".

    But to block this kind of erros in the 1st post i can't find the option to do this.... is it LF_APACHE_403 ?

    Thanks for your help
    Nuno Leite
     
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,723
    Likes Received:
    660
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
  5. nunoleite

    nunoleite Active Member

    Joined:
    Jun 4, 2007
    Messages:
    37
    Likes Received:
    0
    Trophy Points:
    6
    Hi!

    I posted this question on their forum, but i'm waiting for an answer since 15/october.

    Can anyone help here?

    Thanks
    Nuno Leite
     
Loading...

Share This Page