Plesk 12.x / Linux :: How To Enter Range Of IPs To Block
May 25, 2015I am trying to block this whole range of IPs, all that begin with 66.249. How is is that done?
View 1 RepliesI am trying to block this whole range of IPs, all that begin with 66.249. How is is that done?
View 1 RepliesI've just purchased a VPS with Ubuntu 14.04 and Plesk 12 Web Admin Edition. I will use the vps to host just one domain/website. The first time I access Plesk, it asks for some info and first of all it asks form my domain. The default value is localhost.localdomain. Should I leave the default value or should I enter my domain (let's say example.com)?
View 4 Replies View RelatedI set up a forum for a small group of users, so I don't really wish to see spiders or bots on it, so I've put a robots.txt file there to prevent all of them from accessing the forum pages.
I know not all bots follow the robots.txt rule, and these days a really annoying bot called MUNAXNET or Munax AB with IP range 82.99.30.0 - 82.99.30.127 is causing the forum to have extra and unexpected loads.
I've tried to block this IP range with .htaccess and uploaded it to the root of the site a few days ago, here is the content:
<Limit GET HEAD POST>
order allow,deny
deny from 82.99.30.0-82.99.30.127
allow from all
</LIMIT>
However strangely it seems that all of these are not working for this bot, today I saw my forum had 80 users online and that army still keeps coming and browsing all pages of my forums...
I tested the .htaccess with blocking myself, and it actually worked for me, dunno why it's not working for that bot..
Server: OS RHEL 4
Web Server: Apache1.3.37
Hi. I want to block a range of IPs. Currently, I use the following command as an effective weapon against the IPs of people I find in the log trying to do bad things.
/sbin/route add -host x.x.x.x reject
Works like a charm. I then put the offending IP in the file /etc/rc.d/rc.local so that it will reload the bad ips when the server reboots next.
I also use the CSF/LFD firewall, and it successfully blocks single, offensive IPs also.
What I need, though, is the ability to block an entire range of IPs. For example, i have a very persistent hacker trying to access from a certain range like so....
255.155.x.x.
The last two numbers are always changing but the first two remain the same.
How do I block this "range" of IPs from accessing my server?
Note, I know how to block a range of IPs in a .htaccess file for a certain account, I put this in the .htaccess file...
deny from 205.196.
But when I try this with /sbin/route, it will not accept the ip. My firewall will also not accept a range of IPs.
Is there any way to block all and just allow certain IP using APF or iptables?
I want to block all the traffic to the server and just alow IP range.
from 36 hours we have really critical issue:
we have 3 server with Liquidweb that have problem to "resolve" a server locate in Italy
Email sent from server with LW to Italy server is not sent and stay in queue.
We try to force delivery and error is:
Message 1Je39R-0000wk-3N is not frozen LOG: MAIN
cwd=/usr/local/cpanel/whostmgr/docroot 4 args: /usr/sbin/exim -v -M
1Je39R-0000wk-3N delivering 1Je39R-0000wk-3N Connecting to italyserver.com
[**.**.**.**]:25 ... failed: Connection timed out (timeout=5m) LOG: MAIN
italyserver.com [**.**.**.**]:25 Connection timed out LOG: MAIN
== email@italyserver.com R=lookuphost T=remote_smtp defer (110): Connection
== timed out
--
We have check, there aren't problem with port and firewall
All seesm ok, for all server
We have try to restart exim, reboot, ..
Emails don't start from 3 server LW to 1 in Italy
We have try to ping from server LW the Italian server and the problem is the same, found IP but 100% packet lost..
If we ping from 3 server LW a IP of server that is "over" the server IT is all ok
The problem seems only with single IP
So, we have try to send from server in Italy to 1 of 3 server under LW.. same problem
------
Message 1JeSBO-0003CD-HO is not frozen LOG: MAIN
cwd=/usr/local/cpanel/whostmgr/docroot 4 args: /usr/sbin/exim -v -M
1JeSBO-0003CD-HO delivering 1JeSBO-0003CD-HO Connecting to
mail.serverlw.it [**.**.***.**]:25 ... failed: Connection timed out
(timeout=5m) LOG: MAIN mail.serverlw.it [**.**.***.**] Connection
timed out LOG: MAIN
== email@serverlw.it R=lookuphost T=remote_smtp defer (110):
== Connection timed out
------
LW support not have suggest solutions and also Italian support not have idea of problem solution
I use a spam protection service. It works as following : -My DNS are configured to point to a server (sever A) which is configured to filter spams. -If an email is not a spam, the first server send it to my mail server (server B).
But some spammers found a way to bypass the protection : They send directly their email to my mail server (server A). So, i want to allow only emails coming from the server A IP.
I am currently running a virtual server, and over the past couple days have had a number of brute attacks from Chinese and Indian based IP's which have been marked in my logs and trying to break in, this has pulled my websites down with the server load.
I am trying to, in the Firewall settings, add the IP's to a block list, however am unable to see where this can be configured.
Is that possible to block baidu without specifying whole list of IDs it's using ?
View 1 Replies View RelatedI have the problem that the ip blocked "failban" too short (set findtime=1800).
The ip should be blocked for 30 minutes (the second time).
2015-03-23 22:24:59,779 fail2ban.filter [2807]: INFO Set maxRetry = 5
2015-03-23 22:24:59,780 fail2ban.filter [2807]: INFO Set findtime = 1800
2015-03-23 22:24:59,781 fail2ban.actions[2807]: INFO Set banTime = 600
2015-03-27 04:50:56,209 fail2ban.actions[2807]: WARNING [ssh] Ban 195.xxx.xxx.xxx
2015-03-27 05:00:56,913 fail2ban.actions[2807]: WARNING [ssh] Unban 195.xxx.xxx.xxx
2015-03-27 05:09:05,483 fail2ban.actions[2807]: WARNING [ssh] Ban 195.xxx.xxx.xxx
2015-03-27 05:19:06,153 fail2ban.actions[2807]: WARNING [ssh] Unban 195.xxx.xxx.xxx
2015-03-27 05:35:39,317 fail2ban.actions[2807]: WARNING [ssh] Ban 195.xxx.xxx.xxx
2015-03-27 05:45:40,012 fail2ban.actions[2807]: WARNING [ssh] Unban 195.xxx.xxx.xxx
I'm trying to use spamfilter to block mail from specific address, adding this e-mail to spamfilter in mail account settings, but it doesn't work. In logs I see:
spamc[13430]: skipped message, greater than max message size (256000 bytes).
I'd like to know if it's possible with Plesk 12 to block a given domain as destination of emails.
For example: imagine I want some customers not to be able to send emails to addresses in the domain "@parallels.com".
I use Postfix for outgoing mails.
I've seen a number of exploit attemps on the default website which I believe has come via direct access via ip address i.e http://xxx.xxx.xxx.xxx.I have tried to block with .htacess but it seems to be being ignore (possibly by parallels or nginx configuration).how I can block access to the default site to all but 127.0.0.1, server external ip and my ip?
View 19 Replies View RelatedToday I try to fit all FW rules to my need. After i blocked the traffic "allow other incoming traffic" in the Plesk FW i dont get folders listed via FTP. The FTP client connect to my server, but listing content times out. After allow other traffic the content get listed. The rule "Allow FTP connections" ist in all enabled all the time.
View 3 Replies View Relatedi have 2 range ip
range 1 is : 111.111.111-119
range2 is : 222.222.222-229
how may i add both range?
i can add for one range,but about 2 rage i can`t
When I click to Backup Manager it gives an error "Error: 'ascii' codec can't decode byte 0xc4 in position 7: ordinal not in range(128)" , now i can't reach backup properties
View 1 Replies View RelatedI want to ask about some tips to prevent my blog from hacker attack. My friends experience this and i dont want this happen to me. Is web hosting technical support can fix my host server if hacker break it out?
View 10 Replies View Relatedmany visitor cannt enter my site
and many user say that browsing my vbllieten forum very slow
and there is user can crowse my site very fast
i check blocked ip in cvs and there is nothing
my server was hacked by Cold he/she inserted a couple of scripts that enabled remote access into a 777 permission folder.
i found the following script names:
back.pl
cpanel.php
cgitelnet.pl
cpanel.pl
gcc-cold <- shell script
i have deleted all the above files, and changed the folder chmod to 755
but the weird thing is, through shell, when i try to locate the file gcc-cold i get this:
Quote:
root@ [/tmp]# locate gcc-cold
/home/ns5f6/public_html/uploads/gcc-cold
root@ [/tmp]# rm /home/ns5f6/public_html/uploads/gcc-cold
rm: cannot lstat `/home/ns5f6/public_html/uploads/gcc-cold': No such file or directory
isn't locate NOT supposed to find that file after its been deleted? and if it was not deleted some how, isn't it supposed to delete it? am i missing something here??????
from a bit of researching the files, i found that it was a telnet script, BUT i have telnet disabled, and there's no process running along side GREP TELNET
how can i find malicious software or shell scripts that allow such hacking activities on the server?
I have more than 10 servers I need to monitor that servers in one enter face like program our script our any thing
I need to monitor the load & traffic & enter to SSH its can be?
I am using virtuozzo firewall to secure access.
I enter 58.27.175.211/255.255.255.0 for Source Address and Netmask for port 22.
But still I can connect using 58.181.103.217 or 58.27.151.120.
Second is it possible to enter two different ip address in source address?
Let's say when i first joined the datacenter, i'm given some 16 IPs from 123.123.123.*.
Now that i need more IPs, and they have to give me IPs from 123.123.124.*, am i right to say i need a new switch?
Now is it possible that i link up the new switch together, so that both switch can pick up any available IPs from either range?
I'm running a web server with mod_evasive and want to know how can I prevent mod_evasive from blocking the googlebot crawler ip address.
Is there a script out there that can detect this crawler and make sure its ip doesnt get blocked by iptables or mod_evasive?
am using APF firewall and am getting ddos from these range ips
4.68.25.*
8.0.4.*
8.0.5.*
how could i delete all the range from these ip's?
we want a dedicated server with a full range of ip with our own company name(or with my name) and abuse mail
+ kvm and apc access
we need a good support too , for example if we want to check our hard disk the provider check it fast
I need to ban IP range and I inserted say ip 12.44.0.0 in the deny_hosts rules, this should ban range from 12.44 but strange is people from that range still be able to access my site, any idea what went wrong?
View 3 Replies View RelatedI have a client who needs to block IP range on a windows server. However, he is using Cloud hosting from Rackspace. I guess they are not being corporative in doing so. Anyway to do this without root? Perhaps from the control panel?
I am getting my quote back Tuesday but need a little bargaining power with these guys...
Oakland, Ca datacenter
40mbps, 20A, 42U rack.
What should I be looking at price range here, how much per mbps?
Only info I've seen is from 2003 where people were saying $200/mbps. Obviously prices have come WAY down. I've seen people on here reselling internap bandwidth for $12/mbps, but they might have bought a huge commit.
we want a dedicated server with a full range of ip with our own company name(or my name) and our own abuse e-mail address
+ kvm and apc access
we need a good support too , for example if we want to check our hard disk the provider check it fast
any body know anywhere to provide this services with a good price?