spamhaus problem and blocking in 3.2.5 [SOLVED]

rlaughton · Post by **rlaughton** » Sat Aug 24, 2019 7:06 pm

Many, many members (including the Admin Team - including myself and I set up the system!) are now receiving this message:

Your IP 207.246.240.115 has been blocked because it is blacklisted. For details please see http://www.spamhaus.org/query/bl?ip=207.246.240.115

That is not the IP of any of the computers that are accessing the forum, so no idea why we are being blocked and receiving that message?

We have gone through all the details and I checked all my computers for any possible threats. There were none. The warning comes some times but not always.

I have to assume it has something to do with our switch to SSL.

I no longer see any place in the ACP where I can turn off SPAMHAUS?

This is what you get if you check on the spamhaus site: https://www.spamhaus.org/query/ip/207.246.240.121

rlaughton · Post by **rlaughton** » Sat Aug 24, 2019 7:25 pm

Found where to turn it off until we find what is causing the problem:

rlaughton wrote:Sat Aug 24, 2019 7:19 pm See this post - should solve the problem temporarily!

https://cefresearch.ca/phpBB3/viewtopic ... 26#p114326

rlaughton wrote: ↑Sat Aug 24, 2019 7:16 pm In the meantime I have gone to the ACP "Security Settings" and turned off the SPAMHAUS check - took me a while to find it!

Check IP against DNS Blackhole List:
If enabled the user’s IP address is checked against the following DNSBL services on registration and posting: spamcop.net and www.spamhaus.org. This lookup may take a while, depending on the server’s configuration. If slowdowns are experienced or too many false positives reported it is recommended to disable this check.

rlaughton · Post by **rlaughton** » Sat Aug 31, 2019 10:49 am

While trying to resolve another issue I located the origin of the mysterious IP that was appearing in our phpBB3.2.5 forum. It was within our own system and I think it must be related to our PHP at the host.

In the ACP under SYSTEM and then PHP INFORMATION there is a great amount of information. Under the block of information called APACHE ENVIRONMENT there is a lst of variables and values, one of which is the REMOTE_ADDR.

On our ACP it has the following:

REMOTE_ADDR 207.246.240.121

We access our website and databases through https://www.websitesettings.com and I had gone there to check on oour PHP TECHNOLOGY and it says this at the begining of the WEBSITE DETAILS", where the "?" can be clicked so you can change options:

Website Status ? Active
Technology ? Linux / Apache / PHP 7.2
Region ? Phoenix (PHX)

For the REGION I had noticed that sometimes PHX and sometimes LAN. If I click on the "?" it says "Your website can either be in the Lansing (LAN) or Phoenix (PHX) Region". At the time of this posting it has switched to PHX and yesterday it was LAN. Either our host changed it or it changes on its own, I don't know. I presume that is directly related to the fact that our system is on a cloud server and that is where it is located.

If you do a ABUSE check for 207.246.240.121 and look at the Raw Whois Results for that IP, you find out it is located in LANSING, MICHIGAN and it belongs to Liquid Web L.L.C. which is a Data Center / Web Hosting / Transit. Somehow it has got itself listed as being an abuse when it is a remote server. They cover the complete range of NetRange: 207.246.240.0 - 207.246.255.255, so it must fluctuate between different IP addresses, explaining why the SPAMHAUS error reports appear intermitently. They did not appear before we added the SSL certificate, but I have no idea why that changed.

Nobody seems to be doing anything to correct the problem at their end.

Post by **stevemaury** » Sat Aug 31, 2019 1:07 pm

I assume this post is just informational, because I do not see a phpBB issue.

rlaughton · Post by **rlaughton** » Sat Aug 31, 2019 2:08 pm

I should have marked it [SOLVED] as the initial issue was trying to stop SPAMHAUS from blocking access, which I found. As I worked through the issues, I realized that SPAMHAUS was doing its job as it had detected that our REMOTE_ADDR of 207.246.240.121 was apparently being set by our HOST and not by the PHP.

There are a lot of others with the same problem (when you google that issue) but I don't think they have noticed that the block is because of the address in the REMOTE_ADDR. Like me at the start, you look at it and go " that IP of 207.246.240.121 is not my IP!".

I am not a computer techie, just an Admin running a board and learning more every day - harder at 67! Eventually I figure most things out, the group here is very helpful. Once our HOST told me that some of our issues are probably because we are using a "Cloud Server" I started to put the pieces together. Being from the era of IBM 360s and PDP10s, I assumed the server was a physical machine at their office, not somewhere else like Lansing Michigan. It all makes sense now and I hope this helps others googling the same issue.

3Di · Post by **3Di** » Sat Aug 31, 2019 8:24 pm

You can try (not tested)

OPEN ROOT/phpbb/session.php (line 293 approx.)

FIND

Code: Select all

$ip = htmlspecialchars_decode($request->server('REMOTE_ADDR'));

REPLACE WITH

Code: Select all

$ip = (htmlspecialchars_decode($request->server('HTTP_X_FORWARDED_FOR') != '')
	? htmlspecialchars_decode($request->server('HTTP_X_FORWARDED_FOR'))
	: htmlspecialchars_decode($request->server('SERVER_ADDR'))
);

And re-enable Spamhaus. And see what happens.

rlaughton · Post by **rlaughton** » Wed Sep 04, 2019 7:41 pm

Marco:

No I had not seen this. Thanks.

I will wait to see what our HOST does first as I don't want to be changing things at the same time.

Richard