Cloud9

Well-Known Member
Sep 17, 2012
60
1
58
UK
cPanel Access Level
Root Administrator
A customer got blocked by CPhulk due to excessive login attempts (pw on email wrong)

I have now whitelisted his static IP in both CPHulk and CSF, cleared the blocked IP, checked IP tables and restarted cphulk and dovecot

However he is still blocked - emails, domains, cant access the server at all

I am at a loss as to why he is still blocked

Any clues where to look would be helpful
 
Last edited by a moderator:

kodeslogic

Well-Known Member
Apr 26, 2020
320
120
118
IN
cPanel Access Level
Root Administrator
- Is your client able to ping the server IP address from his machine.
- Ask tracert report from your client:
  1. Click Start > Run
  2. In the Run dialog box type “cmd” (without quotes) and press ok
  3. At the DOS Prompt type “tracert your-server-hostname -d” (without quotes)
- Have you ask your client to temporarily check with another ISP? Sometimes this could be an ISP side issue.
 

Cloud9

Well-Known Member
Sep 17, 2012
60
1
58
UK
cPanel Access Level
Root Administrator
Tracert gets all the way to the datacenter - stops a hop before my server

Ping - he can ping the data centre but not my server IP

If they switch to a different IP connection rather then their internet (IP that was blocked) they can then connect to mail and websites on the server
 
Last edited:

kodeslogic

Well-Known Member
Apr 26, 2020
320
120
118
IN
cPanel Access Level
Root Administrator
1. Temporary disable the firewall on your server and check if the client is able to reach the server after disabling the server firewall.
2. If disabling the server firewall doesn't help then to confirm that your server provider is not blocking your client IP address share the tracert report with your server provider and see what they have to say.
 

Cloud9

Well-Known Member
Sep 17, 2012
60
1
58
UK
cPanel Access Level
Root Administrator
Ok more on this

@cPanelMichael

Looks like CPHulk isn't obeying the white list rules

Clients IP is blocked and its not in css or iptables and is white listed

Got client to swop with ISP to another IP address (this is in the white list) and CPHulk has just now blocked this IP address even though its in the white list

Ill open a support ticket I think as looks like a cpanel issue
 

Cloud9

Well-Known Member
Sep 17, 2012
60
1
58
UK
cPanel Access Level
Root Administrator
Ok cPanel say its because he is on user blocked - that ignores the IP white list rules

I have now asked them why when I have a 5 min block is he

1. blocked for days not 5 mins
2. nothing shows in the user blocked list - only in IP blocked (even though his ip is whitelisted)

Seems a bit dumb to have an IP whitelist if userblock ignores this

And its still not working properly as far as I can see

Waiting for another reply
 

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
6,810
895
313
cPanel Access Level
Root Administrator
After some research, it looks like the user was blocked both in cPHulk based on the username, and in the server's firewall based on the IP address, and that the original firewall whitelist rules had a typo in the IP range causing the problem. I believe everything is resolved at this point, but let me know if you need anything else!