NSN blocked user. But IP NOT in the blocked list?

Posted: Sat Dec 23, 2006 12:25 pm

Hello.
I think there might be something wrong with Sentinel (or i might be completely wrong). My website is powered by Nuke-evolution.
http://www.sddesign.biz/site/index.php
I have 2 weird phenomena. I got 2 emails from users that have been banned:

Quote:

*User Agent:* Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.8.0.9) Gecko/20061206 Firefox/1.5.0.9 *Remote Address:* 75.132.32.76 *Client IP:* none *Forwarded For:* none *Date Blocked:* 2006-12-07 @ 08:15:03 CST GMT -0600 *Block expires:* Permanent

Quote:

User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727) Remote Address: 90.192.138.86 Client IP: none Forwarded For: none Date Blocked: 2006-12-07 @ 08:15:03 CST GMT -0600 Block expires: Permanent"

Now when i went to unblock them from NSN, i cant seem to find there I.P in the block list? When i inquired them if they can access the site now, they still cant. and as the block says its permanent they shouldn't be able to access it anyways.

The following is the exhaustive list of all the blocked IP's:

Quote:

Blocked IP Date Expires Reason Functions
216.15.159.130 (00) Unknown 2006-12-23 @ 04:05:15 Permanent Filter
194.146.224.43 (00) Unknown 2006-12-22 @ 14:07:05 Permanent Filter
12.6.95.21 (00) Unknown 2006-12-22 @ 14:04:21 Permanent Filter
212.23.53.151 (00) Unknown 2006-12-22 @ 14:02:11 Permanent Filter
85.92.140.28 (00) Unknown 2006-12-22 @ 13:59:46 Permanent Filter
216.182.96.2 (00) Unknown 2006-12-22 @ 11:05:14 Permanent Filter
193.138.206.126 (00) Unknown 2006-12-21 @ 13:14:12 Permanent Filter
64.20.33.154 (00) Unknown 2006-12-21 @ 09:02:25 Permanent Filter
195.39.164.196 (00) Unknown 2006-12-21 @ 07:05:44 Permanent Filter
194.177.128.241 (00) Unknown 2006-12-21 @ 06:48:18 Permanent Filter
202.83.173.216 (00) Unknown 2006-12-21 @ 01:46:53 Permanent Filter
62.112.194.30 (00) Unknown 2006-12-20 @ 19:13:15 Permanent Filter
69.93.189.130 (00) Unknown 2006-12-20 @ 13:34:31 Permanent Filter
69.55.0.17 (00) Unknown 2006-12-20 @ 13:34:03 Permanent Filter
82.46.153.5 (00) Unknown 2006-12-20 @ 13:31:52 Permanent Referer
163.28.32.104 (00) Unknown 2006-12-20 @ 07:11:46 Permanent Filter
209.8.117.202 (00) Unknown 2006-12-20 @ 07:06:20 Permanent Filter
210.172.116.244 (00) Unknown 2006-12-19 @ 23:00:00 Permanent Filter
193.25.197.126 (00) Unknown 2006-12-19 @ 22:42:35 Permanent Filter
190.36.63.112 (01) IANA Reserved 2006-12-19 @ 20:04:27 Permanent CLike
195.214.44.149 (00) Unknown 2006-12-19 @ 18:24:39 Permanent Filter
213.247.44.16 (00) Unknown 2006-12-19 @ 18:23:52 Permanent Filter
85.234.144.65 (00) Unknown 2006-12-19 @ 18:23:23 Permanent Filter
195.10.193.5 (00) Unknown 2006-12-19 @ 16:28:03 Permanent Filter
64.34.164.179 (00) Unknown 2006-12-19 @ 12:12:37 Permanent Filter
201.223.10.181 (00) Unknown 2006-12-18 @ 22:33:19 Permanent CLike
212.227.118.59 (00) Unknown 2006-12-18 @ 15:33:22 Permanent Filter
212.227.127.15 (00) Unknown 2006-12-18 @ 13:24:57 Permanent Filter
72.4.160.210 (00) Unknown 2006-12-18 @ 12:50:52 Permanent Filter
85.214.43.248 (00) Unknown 2006-12-18 @ 12:49:00 Permanent Filter
81.177.3.223 (00) Unknown 2006-12-18 @ 12:48:11 Permanent Filter
69.13.6.170 (00) Unknown 2006-12-18 @ 12:47:39 Permanent Filter
69.65.126.33 (00) Unknown 2006-12-18 @ 12:42:39 Permanent Filter
216.104.149.111 (00) Unknown 2006-12-18 @ 12:41:52 Permanent Filter
83.149.234.75 (00) Unknown 2006-12-18 @ 08:50:51 Permanent Filter
212.33.133.160 (00) Unknown 2006-12-18 @ 08:49:24 Permanent Filter
69.65.123.81 (00) Unknown 2006-12-18 @ 08:49:12 Permanent Filter
62.213.74.84 (00) Unknown 2006-12-18 @ 08:47:42 Permanent Filter
66.230.167.213 (00) Unknown 2006-12-18 @ 03:18:50 Permanent Script
85.12.15.9 (00) Unknown 2006-12-17 @ 20:24:50 Permanent Filter
190.7.31.196 (01) IANA Reserved 2006-12-12 @ 13:51:33 Permanent Filter
213.193.229.39 (00) Unknown 2006-12-12 @ 12:58:54 Permanent Filter
82.80.253.45 (00) Unknown 2006-12-12 @ 11:17:08 Permanent Filter
217.197.24.254 (00) Unknown 2006-12-12 @ 10:45:10 Permanent Filter
66.70.189.252 (00) Unknown 2006-12-11 @ 16:22:59 Permanent Filter
216.180.243.242 (00) Unknown 2006-12-11 @ 16:21:11 Permanent Filter
85.25.134.198 (00) Unknown 2006-12-11 @ 15:19:46 Permanent Filter
66.249.66.195 (00) Unknown 2006-12-05 @ 00:15:09 Permanent Script

Also, there is another issue. Blocking of "Client IP: none". At times there are blocks that do not have any IP address or any relative information. For example:

Quote:

Date & Time: 2006-12-02 16:17:39 CET GMT +0100
Blocked IP: none...
User ID: Anonymous (1)
Reason: Abuse-Script
--------------------
User Agent: Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Query String:xxxxxxxxxxxxxxxxxxxxxxxxx
Get String: xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Post String: xxxxxxxxxxxxxxxxxxxxxxxxxx
Forwarded For: none
Client IP: none
Remote Address: 74.6.65.227
Remote Port: 58795
Request Method: GET

Although that does not harm anything why are such blocks being caused?
So what is going on here? How do i solve this issue?

registered · Site Admin Joined: Jun 04, 2004 Posts: 6437

You might have another block set that doesn't permanently block them, just sends an email.

Posted: Sat Dec 23, 2006 7:36 pm

Well, in that case why are the users still being blocked from entering the website?
and this is not just me, i have seen a few other users reporting this issue as well. And what of those blocking of "None" I.P.'s?
Thank you for the response.
Please help!

Posted: Sat Dec 23, 2006 10:18 pm

It would still block them - just not add it permanently to the blocked IP list.

Also, I haven't checked the details, but you might look into 2.5.04 - the latest version of NukeSentinel.

Posted: Sun Dec 24, 2006 7:47 am

Hello sir.
Well, i can NOT ban them as they are NOT in the banned list? But still they are being banned Shocked

Isn't that wrong? if someone is banned regardless for however long that MUST appear in the banned I.P. list?
Also, What is the meaning of adding a "no ip" to the banned list?
As for 2.5.04 - i will surely be upgrading shortly.
I hope these issues go away then.
Thank you
SlashDot

New Member Joined: Feb 02, 2007 Posts: 24

I am having the same issue and cannot find a fix. One of my members says he can access with IE but not with AOL from the same PC.

registered · Posted: Thu Mar 01, 2007 6:41 pm

SlashDot, they may just be getting blocked, not banned. You haven't said what they see on their end. It says Client IP is none...maybe that is the invalid IP check kicking in.

To bypass the invalid IP check (my AOL users got this) add

$bypassNukeSentinelInvalidIPCheck = true;

to your config.php.

Posted: Thu Mar 01, 2007 7:10 pm

Does that have to go in any particular place in that file?

Posted: Thu Mar 01, 2007 9:33 pm

No.

registered · Posted: Fri Mar 02, 2007 6:41 am

Just a quick reminder that this "bypass" will not work on most of the older NukeSentinal versions. I do not remember exactly which version it was added, but it was as a result of our RavenNuke 2.10 work, so I suspect it was one of the 2.5.x versions.

Posted: Mon Aug 25, 2008 8:10 am

I too have one client that cannot access any of the sites in my network from one computer. I added

Code:

$bypassNukeSentinelInvalidIPCheck = true;

to the config.php file as suggested above and still they cannot access any of my sites. So far they have tried to access the site from the same location on a laptop and a desktop with the same results. They also tried from his cousin’s house some 30 miles away.

I have no problems accessing any of my sites and neither does he from his laptop or desktop locally. I have no problems accessing my sites from any computer I have access to. I have searched the. htaccess file disabled it and still no access. I cannot find the IP addy anywhere in any of the places I traditionally address such challenges. Thanks in advance for your assistance.

Posted: Mon Aug 25, 2008 10:04 am

What version of Sentinel are you using?

What error is he getting?

Posted: Tue Aug 26, 2008 6:06 am

I presently have an out of the box RavenNuke_v2.20.01 across the board on my sites. I do have heavily modified themes across the board as well. Other than theme modifications everything else is a standard installation.

RavensScripts

Posted: Tue Aug 26, 2008 10:39 am

If it is out of the Box RN 2.20.01 then first off you should upgrade to the latest NS 2.6.01. You also need to make sure you are using the latest IP2C as well.

Can you confirm what error he is getting?

Posted: Mon Oct 13, 2008 2:31 am

Did anyone find a fix for this one? I have a user who has been ok using the site up until a few days ago, Now he gets this error

'You have tried to access this site with an invalid IP!
User Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.3) Gecko/2008092417 Firefox/3.0.3
Remote addess: 92.234.140.29
Client IP: None
Forwarded for: None

I#ve checked for the IP here and also the one he post's with on the forums and can't find it, I'm running RN 2.10.01 NukePHP 7.6 3.3 With NSN 2.5.08 (Not to sure about Upgrading...I tend to f**k it up and block myself and ruin the site lol)

Any ideas?

Posted: Mon Oct 13, 2008 5:46 am

Please search the forums the Invalid IP issue has been discussed before.

You should also update NS, otherwise you site will be vunerable to attack.

Posted: Mon Oct 13, 2008 12:04 pm

Ya I did, I came into here lol

Posted: Mon Oct 13, 2008 12:25 pm

Definitely upgrade then if it doesn't work post back.

Posted: Mon Oct 13, 2008 2:54 pm

cypheroz - as jakec stated, you really need to update NS.
The people that allocate IP addresses often swop and change their data. An IP that might not be allocated when 'list' is drawn up. might be allocated when the next list is drawn up. Likewise and allocated IP might be dropped. For this reason (amongst others) it is important to keep up to date.

If you are managing to block yourself then you need to run the 'scan for admins' in the NS administration area, there are numerous posts here detailing how to carry out that task and it should also be in the documentation.