Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #261519

Debian 12 - IPv4 blocked without fail2ban & co

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hello everyone,

I recently reinstalled a dedicated server (with OVH, in case that helps
with diagnosis), transitioning from Debian 11 to Debian 12.

Since then, I have been experiencing regular and progressive IPv4 blocking
at my home. Access via IPv6 or from another IPv4 (including from the same
provider) is working.

Here's an example from last night after a server reboot the previous
evening:
01:43-02:13 (30 minutes)
02:26-03:26 (1 hour)
03:28-05:28 (2 hours)
05:55-? (still blocked at the time of writing)

Issues:
- The OVH Debian 12 template for dedicated servers doesn't come with any
pre-installed blocking tools (e.g., no fail2ban).
- I haven't added any such tools since installing the server, only Apache
(with mod_security), PHP, and MariaDB.
- From my home IP address last night, the only generated requests were from
my Uptime Kuma probe, which includes a ping every minute and a curl request
to a URL that consistently returns HTTP 200 (except when the IP is blocked,
of course).

When my IP is blocked, curl returns a "Connection refused," and ping
returns "Destination Port Unreachable."

I couldn't find any mentions of my IPv4 address in the server logs. MTR
(-4) doesn't report any issues reaching the server. OVH has confirmed that
it's not an issue with their network equipment, and a rescue mode restart
allows me to regain ping access.

Do you have any ideas about what might be causing this on a nearly pristine
Debian 12 installation? I've been pulling my hair out for a few days now...

Thanks!

Romain

Back to linux.debian.user | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Debian 12 - IPv4 blocked without fail2ban & co Romain <romain@borezo.info> - 2023-09-06 09:00 +0200
  Re: Debian 12 - IPv4 blocked without fail2ban & co Romain <romain@borezo.info> - 2023-09-06 10:50 +0200
  Re: Debian 12 - IPv4 blocked without fail2ban & co Michel Verdier <mv524@free.fr> - 2023-09-06 10:50 +0200
  Re: Debian 12 - IPv4 blocked without fail2ban & co Andy Smith <andy@strugglers.net> - 2023-09-06 11:00 +0200
    Re: Debian 12 - IPv4 blocked without fail2ban & co Romain <romain@borezo.info> - 2023-09-06 11:10 +0200
      Re: Debian 12 - IPv4 blocked without fail2ban & co Andy Smith <andy@strugglers.net> - 2023-09-06 15:30 +0200
        Re: Debian 12 - IPv4 blocked without fail2ban & co Romain <romain@borezo.info> - 2023-09-06 15:40 +0200
          Re: Debian 12 - IPv4 blocked without fail2ban & co Paul van der Vlis <paul@vandervlis.nl> - 2023-09-07 10:00 +0200
            Re: Debian 12 - IPv4 blocked without fail2ban & co Romain <romain@borezo.info> - 2023-09-07 10:40 +0200
  Re: Debian 12 - IPv4 blocked without fail2ban & co Romain <romain@borezo.info> - 2023-09-07 09:40 +0200
    Re: Debian 12 - IPv4 blocked without fail2ban & co Max Nikulin <manikulin@gmail.com> - 2023-09-07 12:20 +0200
      Re: Debian 12 - IPv4 blocked without fail2ban & co Romain <romain@borezo.info> - 2023-09-07 12:30 +0200
        Re: Debian 12 - IPv4 blocked without fail2ban & co Andy Smith <andy@strugglers.net> - 2023-09-07 12:40 +0200
          Re: Debian 12 - IPv4 blocked without fail2ban & co Max Nikulin <manikulin@gmail.com> - 2023-09-07 13:00 +0200
            Re: Debian 12 - IPv4 blocked without fail2ban & co zithro <slack@rabbit.lu> - 2023-09-07 14:20 +0200
              Re: Debian 12 - IPv4 blocked without fail2ban & co Romain <romain@borezo.info> - 2023-09-07 23:50 +0200
                Re: Debian 12 - IPv4 blocked without fail2ban & co Max Nikulin <manikulin@gmail.com> - 2023-09-09 05:00 +0200
                Re: Debian 12 - IPv4 blocked without fail2ban & co Timothy M Butterworth <timothy.m.butterworth@gmail.com> - 2023-09-09 06:50 +0200
                Re: Debian 12 - IPv4 blocked without fail2ban & co Romain <romain@borezo.info> - 2023-09-09 10:40 +0200

csiph-web