Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 1 subscriber
  • Views 1851 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to block an IP adress if using the Webserver Protection feature ?

willemsej
I see a lot of action from certain IP adresses example is 66.249.76.38.
I would like to block all traffic from this IP adress, how can this be done ? [:@]

When I use the normal firewall rules it does not seem to help. [:(]

Information:
2013:02:26-21:28:36 firewall reverseproxy: srcip="66.249.76.38" localip="192.168.x.y" size="210" user="-" host="66.249.76.38" method="GET" statuscode="401" reason="-" extra="-" time="79089" url="/help/help85_admin.nsf/Contents!OpenView&Start=8.2.11&Count=30&Expand=10.7&BaseTarget=Topic&Click=" server="www.badkey.com" referer="-" cookie="-" set-cookie="-"

2013:02:26-21:29:14 firewall reverseproxy: srcip="66.249.76.38" localip="192.168.x.v" size="210" user="-" host="66.249.76.38" method="GET" statuscode="401" reason="-" extra="-" time="103556" url="/help/help85_admin.nsf/Contents!OpenView&Start=9.3&Count=30&Expand=18.13&BaseTarget=Topic&Click=8525760B004BE32D.01236fd814e158e285256b8700683832/$Body/0.1FC" server="www.badkey.com" referer="-" cookie="-" set-cookie="-"

Website is Badkey Corner


This thread was automatically locked due to age.
  • 0
    This is solved by a DNAT to a non-existant IP.  I call it Rule #2:

    In general, a packet arriving at an interface is handled only by one of the following, in order:
    DNATs first, then VPNs and Proxies and, finally, manual Routes and Firewall rules.



    Cheers - Bob
    PS I've moved this to the proper forum.
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0
    follow Bob recommendation to block, but that IP (66.249.76.38)
    is from googlebot servers witch index your site tor google search
    in other words is in your service by your request
  • 0 in reply to Ol Deda
    follow Bob recommendation to block, but that IP (66.249.76.38)
    is from googlebot servers witch index your site tor google search
    in other words is in your service by your request


    I removed myself long ago. I instlled robots.txt yesterday hoping they will all stop. Thanks for the info! [:)]
  • 0 in reply to BAlfson
    This is solved by a DNAT to a non-existant IP.  I call it Rule #2:

    In general, a packet arriving at an interface is handled only by one of the following, in order:
    DNATs first, then VPNs and Proxies and, finally, manual Routes and Firewall rules.



    Cheers - Bob
    PS I've moved this to the proper forum.


    Thanks. Looks fine again.
Unfiltered HTML