This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ARRGHHH - Astaro blocking certain site all of the sudden - please help

Hey guys. I am about ready to remove the Astaro… ARGHHH. I haven’t posted here in some time as it has been running super smooth, but over the past few days, everything just went to crap. Here is what has taken place – about 2 days ago I started having issues FTP’ing into my personal web site. I could FTP in about 1 out of every 5 tries. Then it just stopped working altogether. So I opened a work order with GoDaddy thinking it was on their end. Today I come home and I cannot get on any of my sites that are on GoDaddy. Not sure why it has decided to block just my site as other sites are working without issue. I have a couple hundred favorites and I just started randomly checking those and I found no issues other than MY sites.

 2009:11:04-17:44:30 Firewall httpproxy[4169]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.1.100" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2145" time="61025 ms" request="0xb2292308" url="www.dwellydesigns.com/" exceptions="av,auth,content,url" error=""

I have tried to make as many exceptions as I can and nothing seems to work. I love the Astaro, but I have to be able to access these site more than I need to use the Astaro. Can anyone please help me here? BTW, I am running firmware 7.501 – thanks!!!

Erik

P.S. I did try using the search function and I tried several thing, just couldn't get any of them to work...

This thread was automatically locked due to age.

Parents

0 edwelly over 16 years ago

Ok - when I try and request my site: dwellydesigns.com, this is what the Content Filter in the HTTP/S log file shows

2009:11:05-20:09:17 Firewall httpproxy[2059]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.1.100" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2183" time="62067 ms" request="0xb2207d10" url="www.dwellydesigns.com/" exceptions="" error="" category="178" reputation="neutral" categoryname="Internet Services"

And here is the IPS log

2009:11:05-08:14:58 Firewall snort[9696]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="LAND Attack, sameip detected" group="242" srcip="192.168.1.70" dstip="192.168.1.70" proto="6" srcport="3500" dstport="80" sid="200012" class="" priority="0"  generator="1" msgid="0"

2009:11:05-08:15:14 Firewall snort[9696]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="LAND Attack, sameip detected" group="242" srcip="192.168.1.70" dstip="192.168.1.70" proto="6" srcport="3501" dstport="443" sid="200012" class="" priority="0"  generator="1" msgid="0"

Any suggestions?

Reply

0 edwelly over 16 years ago

Ok - when I try and request my site: dwellydesigns.com, this is what the Content Filter in the HTTP/S log file shows

2009:11:05-20:09:17 Firewall httpproxy[2059]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.1.100" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2183" time="62067 ms" request="0xb2207d10" url="www.dwellydesigns.com/" exceptions="" error="" category="178" reputation="neutral" categoryname="Internet Services"

And here is the IPS log

2009:11:05-08:14:58 Firewall snort[9696]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="LAND Attack, sameip detected" group="242" srcip="192.168.1.70" dstip="192.168.1.70" proto="6" srcport="3500" dstport="80" sid="200012" class="" priority="0"  generator="1" msgid="0"

2009:11:05-08:15:14 Firewall snort[9696]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="LAND Attack, sameip detected" group="242" srcip="192.168.1.70" dstip="192.168.1.70" proto="6" srcport="3501" dstport="443" sid="200012" class="" priority="0"  generator="1" msgid="0"

Any suggestions?

Children

No Data