This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

dnsbl.proxybl.org offline?

This morning I got a bunch of calls about all of our websites/portals taking 20+ seconds to load a page.  I jumped on our web server and it was running fine so I logged into the UTM and opened the WAF live log and saw a ton of these for every page request:

DNS lookup for 83.16.168.192.dnsbl.proxybl.org. failed

This the the dns reputation lookup that we current have turned on.  It appears that proxybl.org has had it's DNS wiped out!

I have temporarily turned off the reputation lookup and things are again running normal.  Just thought I would share in case anyone else is experiencing this.

Dave

This thread was automatically locked due to age.

0 BarryG over 10 years ago

Hi, thanks for posting this.

Which UTM version are you running?

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 dcline97 over 10 years ago

we have a UTM 220 and are running 9.209-8.

About two hours after I did the original post, dnsbl.proxybl.org came back online.

All is well again!

Dave
Cancel
Vote Up 0 Vote Down

Cancel
0 dcline97 over 9 years ago

Its down again - in case anyone is having reputation check failures and 20+ second website response time.
Cancel
Vote Up 0 Vote Down

Cancel
0 TheDrew over 9 years ago

Somebody DDOSing them maybe?
Cancel
Vote Up 0 Vote Down

Cancel
0 Longman over 9 years ago

Same issue - thanks for posting.
Cancel
Vote Up 0 Vote Down

Cancel
0 jobo2 over 9 years ago

It's amazing how bad the performance gets from failed DNS lookups.
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 9 years ago

Yes they are down. You have to turn off reputation checking to eliminate the error currently -- I had this affect website access performance at one customer site already due to this issue. You can't granularly turn off that one RBL -- the UTM uses 3 of them for this feature currently. I've started a support case already with Sophos to find out how to turn out the one RBL that's dead.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel

0 teched_01 over 9 years ago

Use at your own risk, effects entirely untested by me - please let me know how/if it works for you.

check original settings:


# cc get reverse_proxy blacklist dnsrbl_zones

[

          'black.rbl.ctipd.astaro.local',

          'dnsbl.proxybl.org',

          'http.dnsbl.sorbs.net'

        ]

Change, less dnsbl.proxybl.org:


# echo -e 'reverse_proxy\n blacklist\n dnsrbl_zones@\n =["black.rbl.ctipd.astaro.local","http.dnsbl.sorbs.net"]\n' | cc --batch

Change back:


# echo -e 'reverse_proxy\n blacklist\n dnsrbl_zones@\n =["black.rbl.ctipd.astaro.local","dnsbl.proxybl.org","http.dnsbl.sorbs.net"]\n' | cc --batch

0 BrucekConvergent over 9 years ago in reply to teched_01

Teched, just a FYI, your script commands work fine.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel
0 SheldonX over 9 years ago

I'd like to confirm, commands work well! Thanks!
Cancel
Vote Up 0 Vote Down

Cancel