CPHulk Blocked

[Cloud9]

A customer got blocked by CPhulk due to excessive login attempts (pw on email wrong)

I have now whitelisted his static IP in both CPHulk and CSF, cleared the blocked IP, checked IP tables and restarted cphulk and dovecot

However he is still blocked - emails, domains, cant access the server at all

I am at a loss as to why he is still blocked

Any clues where to look would be helpful

 

[kodeslogic]

- Is your client able to ping the server IP address from his machine.
- Ask tracert report from your client:

1. Click Start > Run
2. In the Run dialog box type “cmd” (without quotes) and press ok
3. At the DOS Prompt type “tracert your-server-hostname -d” (without quotes)

- Have you ask your client to temporarily check with another ISP? Sometimes this could be an ISP side issue.

 

[Cloud9]

Tracert gets all the way to the datacenter - stops a hop before my server

Ping - he can ping the data centre but not my server IP

If they switch to a different IP connection rather then their internet (IP that was blocked) they can then connect to mail and websites on the server

 

[kodeslogic]

1. Temporary disable the firewall on your server and check if the client is able to reach the server after disabling the server firewall.
2. If disabling the server firewall doesn't help then to confirm that your server provider is not blocking your client IP address share the tracert report with your server provider and see what they have to say.

 

[Cloud9]

Thanks ill try that

 

[kodeslogic]

You're most welcome.

 

[Cloud9]

Ok more on this

@cPanelMichael

Looks like CPHulk isn't obeying the white list rules

Clients IP is blocked and its not in css or iptables and is white listed

Got client to swop with ISP to another IP address (this is in the white list) and CPHulk has just now blocked this IP address even though its in the white list

Ill open a support ticket I think as looks like a cpanel issue

 

[cPRex]

@Cloud9 - can you post the ticket number here so I can follow along?

 

[Cloud9]

@Cloud9 - can you post the ticket number here so I can follow along?

Ticket #94311127

Sorry for delay

 

[cPRex]

Thanks for providing that - I'm following along on my end now :D

 

[Cloud9]

Ok cPanel say its because he is on user blocked - that ignores the IP white list rules

I have now asked them why when I have a 5 min block is he

1. blocked for days not 5 mins
2. nothing shows in the user blocked list - only in IP blocked (even though his ip is whitelisted)

Seems a bit dumb to have an IP whitelist if userblock ignores this

And its still not working properly as far as I can see

Waiting for another reply

 

[cPRex]

After some research, it looks like the user was blocked both in cPHulk based on the username, and in the server's firewall based on the IP address, and that the original firewall whitelist rules had a typo in the IP range causing the problem. I believe everything is resolved at this point, but let me know if you need anything else!