Nuke Sentinal and UK AOL Users Problem

Involved Joined: Feb 03, 2006 Posts: 269

Hey peeps

i am being inundated (only about 15 so far lol ) with UK AOL ISP users saying they are being blocked by sentinel from entering my site

on looking into this matter further its not actually banning them but just blocking them stating they are using an invalid IP

here is a list of some of the IP's it is blocking that the users have sent me

92.20.212.92
92.4.153.10
92.0.201.229
92.11.1.199
92.251.80.148
92.1.171.247

after chatting to the individuals i found out that they were all AOL users and one contacted AOL directly and they informed them that they were in the process of moving all UK clients from US servers to UK.. and there was nothing that they could do.

Im presuming the range has been banned, but not by me .. by default settings in Sentinel.

should i just remove the range ban ?

im using Sentinel version 2.5.16

Posted: Fri May 16, 2008 12:26 pm

Have you got the proxy blocker turned on?

Posted: Fri May 16, 2008 12:29 pm

set to mild yes

Posted: Fri May 16, 2008 12:33 pm

Try switching it to lite, or off completely.

Posted: Fri May 16, 2008 12:36 pm

ok ill give it a blast, wont it allow users to use programs such as Hide IP dont they abuse proxys

thanks for your fast replies jakec, much appreciated !

Posted: Fri May 16, 2008 12:39 pm

Possibly, the problem is AOL use proxies.

Posted: Fri May 16, 2008 1:46 pm

Yes, the problem is with them moving to UK IP addresses.
The chances are high that they have been given a block, or several blocks (CIDR's) of IP addresses but they haven't told anyone they are actually using them.

As a consequence of their 'mushroom' mentality, the IP's may well still be listed officially as 'unallocated' or unused, so those bits of kit like Nuke Sentinel that rely on third party GEOIP information, may be wrong until the official lists are updated.
It would be well worth ensuring you are running the latest IP2C list from www.nukescripts.net

If you still have problems with the latest IP2C data imported, you may have to add the IP manually through NS admin.

Worker Joined: Aug 26, 2007 Posts: 236

You can check in Sentinel by the function Search adresses, if those addresses are included in IP2Country that you have. If they not it will give invalid address and you need to update the IP2Country tables.

Posted: Sat May 17, 2008 3:39 am

i just upgraded nuke sentinal to 2.17 and i updated all of the IP2Country's from the latest downloads at NSN

i just checked the first IP addy from one of my users and its showing this

so im presuming from that result that all IPs in that range are blocked ?

Posted: Sat May 17, 2008 4:11 am

The country flag is showing so this would indicate that the IP range is now known and will no longer produce the invalid ip message.

Posted: Sat May 17, 2008 6:19 am

Thanks all for all your kind help.. very much appreciated indeed

Im a total retard when it comes to sentinel Smile

Posted: Sat May 17, 2008 10:37 am

Any time

Posted: Sat May 17, 2008 10:52 am

What about this one, some one just mailed me saying there still blocked but there IP is different though.. strange this is he is one of my mods and has had access to the site for months... and is not an AOL user ... Sad

here is the screenie

Posted: Sat May 17, 2008 11:37 am

Hmm, and he says the error is the same "invalid IP" message?

Posted: Sun May 18, 2008 1:24 am

Quote:

You have been blocked from entering this site.

You have attempted to improperly access the admin area of this site.

All of the following information has been gathered to assist the webmaster should this need to be reported to local or federal law enforcement.

If you think this is a mistake you can contact the site webmaster at admin(at)clan-themes(dot)co(dot)uk.
Be SURE to include the following information in any email!

User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648)
Remote Address: 195.188.152.12
Client IP: none
Forwarded For: 92.236.68.147
Date Blocked: __TIMEDATE__
Block expires: __DATEEXPIRES__

well he reckons that it used to say invalid ip but since updating its now saying admin ban.

Daft thing is i have searched for his IP in the banned range and its not there, could it have banned someone else in the range and also prevented him access ?

sorry about this..

Posted: Sun May 18, 2008 1:47 am

Also check the .htaccess file.

Posted: Sun May 18, 2008 2:32 am

Sounds like his admin cookie has expired and he accessed an admin link without logging into admin.
Run the 'scan for new admins' in NS admin to make sure you add his IP to the protected range.
If his IP is not in the blocked ip or blocked_range table and not in the htaccess (if you have 'write to htaccess' enabled then he should be able to access the site.

Posted: Sun May 18, 2008 2:38 am

@ jakec i did check the .htaccess file and the IP wasn't in there

@ Guardian2003 sorry for the confusion, he wasn't admin just a forums moderator

Posted: Sun May 18, 2008 3:27 am

The error message he got indicates he tried to access an admin function so he was blocked correctly. However, as his IP is not listed in the tables above or the htaccess file then he doesn't appear to 'banned'.
If he is getting this message say when visiting your homepage then that's a different problem Sad

Posted: Sun May 18, 2008 3:29 am

Actually, to save arguments, you could us Nuke Sentinels 'Traccked IP' -> Tracked Users to find out exactly which url's he was accessing Wink

Posted: Sun May 18, 2008 5:40 am

Guardian2003 wrote:

Actually, to save arguments, you could us Nuke Sentinels 'Traccked IP' -> Tracked Users to find out exactly which url's he was accessing Wink

Ah good idea ill check now

Posted: Sun May 18, 2008 5:45 am

he only visited forums pages Sad

weird...

registered · Posted: Mon May 19, 2008 5:26 am

This is weird and I am not sure what is going on. Please check your proxy blocker settings and turn that off, and then check back with your UK AOL users. It is the only thing AOL related that I can think of ATM.

Posted: Mon May 19, 2008 6:58 am

proxy was at lite ive turned it off now, see if he can get on

registered · Posted: Mon May 19, 2008 7:57 am

You can always just turn off that invalid IP address check if it is more trouble than it is worth for you.