Resolved Can we change/tune the "frequency" filtering?

[DRAX]

Ok, Dev Team is not able to duplicate the issue and in fact I can not either. They are suspecting your net connections but they are now checking into the firewall and other logs. Will post more when I am told.....

I mean, the screenshot I attached proves it's OB's web firewall service that is doing it. The dev's IPs may be whitelisted which will prevent them from being impacted as well.

I was able to make it happen by opening roughly 8 tabs of OB pages in about 8 seconds. I was then blocked by the OB web firewall for 15 minutes. The web firewall is a 3rd party service external to OB's web instances.

 

[tjZ06]

I mean, the screenshot I attached proves it's OB's web firewall service that is doing it. The dev's IPs may be whitelisted which will prevent them from being impacted as well.

I was able to make it happen by opening roughly 8 tabs of OB pages in about 8 seconds. I was then blocked by the OB web firewall for 15 minutes. The web firewall is a 3rd party service external to OB's web instances.

Exactly. The dev team needs to duplicate from non-whitelisted IPs/subnets. @DRAX did the heavy-lifting showing it's the web firewall (as opposed to forum software), which also proves it's not my connection (or his).

-TJ

 

[Jim SoG]

From Dev Team: I’ve made an adjustment for this issue. Please let us know if this is reported again.
Clear Cache and reboot.

Jim

 

[slomatt]

I just ran into this issue about 20 minutes ago. After opening about 5 pages in new tabs the next page load spun for a while and then I received a "This site can't be reached" error because the site too too long to respond. A few minutes later when I tried to visit the site I saw a "Access Denied - Securi Website Firewall" page.

The ~5 pages were opened a few seconds apart, so I am surprised this rate of traffic caused the IDS to temporarily block my IP. I have screenshots of both errors if they would help.

 

[Jim SoG]

Ok will report it. Thank you.

 

[tjZ06]

From Dev Team: I’ve made an adjustment for this issue. Please let us know if this is reported again.
Clear Cache and reboot.

Jim

Awesome, thanks! I just tested and the issue still exists, but it seems like a higher threshold (my non-scientific testing says it was raised to 10 concurrent connections/tabs).

-TJ

 

[Jim SoG]

I just ran into this issue about 20 minutes ago. After opening about 5 pages in new tabs the next page load spun for a while and then I received a "This site can't be reached" error because the site too too long to respond. A few minutes later when I tried to visit the site I saw a "Access Denied - Securi Website Firewall" page.

The ~5 pages were opened a few seconds apart, so I am surprised this rate of traffic caused the IDS to temporarily block my IP. I have screenshots of both errors if they would help.

Can you post the screen shots please.....

 

[slomatt]

Can you post the screen shots please.....

Sure, here you go.

 

[Jim SoG]

From the brains: I do have a ticket open with the provider of the firewall software and I think I know what is causing the issue (though not how to solve, yet). the screenshots will be useful for troubleshooting and for verification, assuming we can get a fix in place, so that we can monitor whether the specific issue occurs again

 

[Jim SoG]

Another update: I have two more modifications in place so now we will observe again

SO give it a try please.....

Thanks for your patience guys!

Jim

 

[tjZ06]

Another update: I have two more modifications in place so now we will observe again

SO give it a try please.....

Thanks for your patience guys!

Jim

Interestingly, it seems to have gotten a bit worse, at least in specific scenarios. I went back to an old thread and just tried to open 2 additional tabs of images in the thread, and hit the wall.

-TJ

 

[KonzaLander]

It got me a couple of weeks ago... and again today!

 

[Jim SoG]

TJ what thread was it that did that?

 

[Jim SoG]

Also guys, take screenshots, do not block out anything (i.p.) and PM them to me so I can give to the dev team. They are seeing 1 and only 1 case of the host blocking anyone and it is coming in as a BOT.

Jim

 

[KonzaLander]

The forum has been pretty unbearable to use today.

 

[Jim SoG]

Ok been fixed......Thank you.

 

[tjZ06]

Ok been fixed......Thank you.

Awesome news, thanks! I'll let you know if I run into any issues.

-TJ

 

[slomatt]

It seems like the firewall has become more strict again. Several times in the last few days I've opened ~5 tabs in somewhat quick succession and then gotten locked out of the site for 10-15 min, which is pretty annoying.

 

[Jim SoG]

WE also have been under attack and that firewall is saving us.... We might need to adjust to it.

Jim

 

[tjZ06]

It seems like the firewall has become more strict again. Several times in the last few days I've opened ~5 tabs in somewhat quick succession and then gotten locked out of the site for 10-15 min, which is pretty annoying.

Same here.

WE also have been under attack and that firewall is saving us.... We might need to adjust to it.

Jim

Interesting. What is the attack vector? Does it manifest as similar Layer 5 ports/protocols as opening lots of tabs?

-TJ