Blocked because of "Client IP: none"

Worker Joined: Dec 08, 2005 Posts: 107

Hi All!

I am using RN 2.02. I have had a couple of cases in the past few days where users have been blocked with messages claiming they have attempted a string attack. The data looks like this:

User Agent: Mozilla/5.0 (compatible; Konqueror/3.3; Linux) (KHTML, like Gecko)
Remote Address: X.X.X.X
Client IP: none
Forwarded For: 127.0.0.1
Date Blocked: 2007-05-14 @ 21:39:09 EDT GMT -0400
Block expires: Permanent

I found references in the forums indicating that the problem is "Client IP: none". While I understand the necessity for things like this, I am curious about a couple of things.

First, why this is being reported as a string attack? I looked in nukesentinel.php and did not see anything that would cause this to be considered a string attack. Also, I see nothing in the "String Blocker Settings" or the general configuration that defaults to the string attacks. In each case the Remote Address is valid.

The other thing is how to prevent this kind of thing. I could protect the IPs in question, but that seems like the long way around. Since the remote address is valid, is there way of configuring Sentinel so that it does not block if the Client IP is none?

Any help is appreciated.

Sells PC To Pay For Divorce Joined: Posts: 5661

have a look at this..
http://www.ravenphpscripts.com/postt13231.html

Posted: Sat May 26, 2007 1:28 am

Thanks for the tip. However, I am confused now. Inside nukesentinel.php I have commented out the entire block "Invalid ip check". I did this because of something in another post, but it seems that setting
$bypassNukeSentinelInvalidIPCheck = TRUE is the cleaner solution. However, as far as I can see, the only place the value is checked in inside that block in nukesentinel.php. So, if the block is commented out, it should have the same effect. Or am I missing something?

registered · Posted: Sat May 26, 2007 12:41 pm

Sentinel lists a reason for a block, and I don't see it in the info you gave. The Client IP: none may not be the reason, it may just be reporting the fact that the client had masked their IP. Sentinel will also report the GET and POST strings. Do you have these? These would be helpful in trying to decide if it tripped on a string block.

Posted: Thu May 31, 2007 12:39 pm

In each case it says

You have been blocked from entering this site.
You have attempted a String attack on this site.

I cannot see anything in the string block configuration that should cause problems. First, it is simply a list of domain names that are know spam havens, etc. (pulled off the forums here). In nukesentinel.php, I see in the block following "Check for Strings", it looks at query_string, get_string, and post_string. A couple of users are saying they are blocked even when inputting the main URL directly with no query string, so I am assuming no get_string or post_string.

For all blocks, I have email notification activated, but the IPs being blocked like this are not being reported via email. I also do not find any matching IP ranges being blocked.

Posted: Mon Jun 11, 2007 11:07 pm

I hate to be a pest, but I still have this problem. From all I see so far, this should not be happening. I am more than willing to provide any additional information or change the code to track down this problem. I just need someone to tell me where and what.

best regards,

jimmo

registered · Posted: Tue Jun 12, 2007 6:53 am

jimmo, check out this thread here. I believe BobMarion posted a code change that might work for you.

Posted: Tue Jun 12, 2007 6:54 am

I guess it would have worked out better for me to actually post the !@#$% link! Embarassed

Here it is: http://www.ravenphpscripts.com/postx13219-0-0.html