Debian 12 - IPv4 blocked without fail2ban & co

Path	csiph.com!fu-berlin.de!bofh.it!news.nic.it!robomod
From	Romain <romain@borezo.info>
Newsgroups	linux.debian.user
Subject	Debian 12 - IPv4 blocked without fail2ban & co
Date	Wed, 06 Sep 2023 09:00:02 +0200
Message-ID	<HaUG6-72RC-5@gated-at.bofh.it> (permalink)
X-Mailbox-Line	From debian-user-request@lists.debian.org Wed Sep 6 06:50:23 2023
Old-Return-Path	<romain@borezo.info>
X-Amavis-Spam-Status	No, score=-5.1 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FOURLA=0.1, HTML_MESSAGE=2, LDO_WHITELIST=-5] autolearn=no autolearn_force=no
X-Policyd-Weight	using cached result; rate: -5.5
X-Greylist	delayed 586 seconds by postgrey-1.36 at bendel; Wed, 06 Sep 2023 06:50:02 UTC
X-Gm-Message-State	AOJu0Yw8vQYAw7CoGQespa152fEJxRvgStKz2OedjYTIL5d5ZeL8L+aH y3kEzh+LGLOsQ339yjcqOaCy5vCNnsM2896HHT4=
X-Google-SMTP-Source	AGHT+IEsQNPDiHF7r7TTrF9L2xcgOl0wQT+Woqtw0qfs3l0Rk08rX9OtQfudBHSRAEbui3jENffT+O4SHAKcM7q4jDE=
X-Received	by 2002:a4a:3113:0:b0:571:28d5:2c74 with SMTP id k19-20020a4a3113000000b0057128d52c74mr12580793ooa.4.1693982411503; Tue, 05 Sep 2023 23:40:11 -0700 (PDT)
MIME-Version	1.0
X-Gmail-Original-Message-ID	<CACSUs86MTrnvJVSGX54QkKUBtBi9=R+Sef6J2emNAROhQ1NJgA@mail.gmail.com>
Content-Type	multipart/alternative; boundary="000000000000e4be520604ab03b9"
X-Last-Tls-Session-Version	TLSv1.3
X-Mailing-List	<debian-user@lists.debian.org> archive/latest/803173
List-ID	<debian-user.lists.debian.org>
List-URL	<https://lists.debian.org/debian-user/>
List-Archive	https://lists.debian.org/msgid-search/CACSUs86MTrnvJVSGX54QkKUBtBi9=R+Sef6J2emNAROhQ1NJgA@mail.gmail.com
Approved	robomod@news.nic.it
Lines	74
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Date	Wed, 6 Sep 2023 08:39:55 +0200
X-Original-Message-ID	<CACSUs86MTrnvJVSGX54QkKUBtBi9=R+Sef6J2emNAROhQ1NJgA@mail.gmail.com>
Xref	csiph.com linux.debian.user:261519

Show key headers only | View raw

[Multipart message — attachments visible in raw view] - view raw

Hello everyone,

I recently reinstalled a dedicated server (with OVH, in case that helps
with diagnosis), transitioning from Debian 11 to Debian 12.

Since then, I have been experiencing regular and progressive IPv4 blocking
at my home. Access via IPv6 or from another IPv4 (including from the same
provider) is working.

Here's an example from last night after a server reboot the previous
evening:
01:43-02:13 (30 minutes)
02:26-03:26 (1 hour)
03:28-05:28 (2 hours)
05:55-? (still blocked at the time of writing)

Issues:
- The OVH Debian 12 template for dedicated servers doesn't come with any
pre-installed blocking tools (e.g., no fail2ban).
- I haven't added any such tools since installing the server, only Apache
(with mod_security), PHP, and MariaDB.
- From my home IP address last night, the only generated requests were from
my Uptime Kuma probe, which includes a ping every minute and a curl request
to a URL that consistently returns HTTP 200 (except when the IP is blocked,
of course).

When my IP is blocked, curl returns a "Connection refused," and ping
returns "Destination Port Unreachable."

I couldn't find any mentions of my IPv4 address in the server logs. MTR
(-4) doesn't report any issues reaching the server. OVH has confirmed that
it's not an issue with their network equipment, and a rescue mode restart
allows me to regain ping access.

Do you have any ideas about what might be causing this on a nearly pristine
Debian 12 installation? I've been pulling my hair out for a few days now...

Thanks!

Romain

Back to linux.debian.user | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Debian 12 - IPv4 blocked without fail2ban & co Romain <romain@borezo.info> - 2023-09-06 09:00 +0200
  Re: Debian 12 - IPv4 blocked without fail2ban & co Romain <romain@borezo.info> - 2023-09-06 10:50 +0200
  Re: Debian 12 - IPv4 blocked without fail2ban & co Michel Verdier <mv524@free.fr> - 2023-09-06 10:50 +0200
  Re: Debian 12 - IPv4 blocked without fail2ban & co Andy Smith <andy@strugglers.net> - 2023-09-06 11:00 +0200
    Re: Debian 12 - IPv4 blocked without fail2ban & co Romain <romain@borezo.info> - 2023-09-06 11:10 +0200
      Re: Debian 12 - IPv4 blocked without fail2ban & co Andy Smith <andy@strugglers.net> - 2023-09-06 15:30 +0200
        Re: Debian 12 - IPv4 blocked without fail2ban & co Romain <romain@borezo.info> - 2023-09-06 15:40 +0200
          Re: Debian 12 - IPv4 blocked without fail2ban & co Paul van der Vlis <paul@vandervlis.nl> - 2023-09-07 10:00 +0200
            Re: Debian 12 - IPv4 blocked without fail2ban & co Romain <romain@borezo.info> - 2023-09-07 10:40 +0200
  Re: Debian 12 - IPv4 blocked without fail2ban & co Romain <romain@borezo.info> - 2023-09-07 09:40 +0200
    Re: Debian 12 - IPv4 blocked without fail2ban & co Max Nikulin <manikulin@gmail.com> - 2023-09-07 12:20 +0200
      Re: Debian 12 - IPv4 blocked without fail2ban & co Romain <romain@borezo.info> - 2023-09-07 12:30 +0200
        Re: Debian 12 - IPv4 blocked without fail2ban & co Andy Smith <andy@strugglers.net> - 2023-09-07 12:40 +0200
          Re: Debian 12 - IPv4 blocked without fail2ban & co Max Nikulin <manikulin@gmail.com> - 2023-09-07 13:00 +0200
            Re: Debian 12 - IPv4 blocked without fail2ban & co zithro <slack@rabbit.lu> - 2023-09-07 14:20 +0200
              Re: Debian 12 - IPv4 blocked without fail2ban & co Romain <romain@borezo.info> - 2023-09-07 23:50 +0200
                Re: Debian 12 - IPv4 blocked without fail2ban & co Max Nikulin <manikulin@gmail.com> - 2023-09-09 05:00 +0200
                Re: Debian 12 - IPv4 blocked without fail2ban & co Timothy M Butterworth <timothy.m.butterworth@gmail.com> - 2023-09-09 06:50 +0200
                Re: Debian 12 - IPv4 blocked without fail2ban & co Romain <romain@borezo.info> - 2023-09-09 10:40 +0200

csiph-web