Sudden issues today with domain blocks

[melloman]

Hi,

Suddenly today I have been unable to perform a CURL command to api.domain.com. I am able to curl to example.com (both http & https).

This is what happens on the SSH command line:
curl -v https://api.domain.com/healthcheck
* About to connect() to api.domain.com port 443 (#0)
* Trying 52.62.14.35...
* Connection timed out
* Trying 13.55.5.15...
* After 86364ms connect time, move on!
* Failed connect to api.domain.com:443; Operation now in progress

If I disable the CSF firewall in WHM, the api.stripe.com curl command connects correctly,

I've tried clearing the block list, disabled LF_SPI. Nothing apart from completely disabling the firewall or whitelisting all the IP addresses associated with api.stripe.com will fix the issue.

The other issue I'm having (which started today also) is that email isn't coming through to the server. I disabled CSF firewall and email starts coming through again.

Does anyone know how this can be fixed or where to look?

 

[cPanelLauren]

This sounds like an issue with CSF which is a 3rd party software and not something managed by cPanel. I can suggest that you check the following location for blocked IP addresses:

/etc/csf/csf.deny

You might also want to check iptables specifically, the following will show you the IPs added to iptables and a comment if available on why it was added

iptables -S

To prevent this from occurring though, I would add the provider's IP addresses to the whitelist.