DynDNS blocked me

rds_correia

Well for now I'm unblocked since 5h35 this morning (CET) 8), and haven't been blocked until now (3h15 afternoon)…

Howcome? Here it's still 3h05pm :D.

Anyway I had already been blocked before because of this issue.
This time I was deleted!
Let's see how easy it will be to bring that account back alive.
Though, many thanks for your positive feedback ;).

@Scott
Sorry but I suck at *BSD/Linux.
Those commands you posted how shall I run them?
I was trying to do a "cd /etc/crontab" from the Diagnostics > Command Prompt.
It seems to accept it but then I do a "pwd" just to find out that I'm still stuck at "/usr/local/www".
How can I change directories from the command prompt to run those commands you posted?
TIA
Cheers

mickeybyte

Hi,

better activate ssh and use a ssh session to do it.

You can however run the commands in the exec.php window, one at a time, but a "cd" won't work, because each time you are indeed again in the default directory

MickeyByte

rds_correia

Thanks mickeybyte ;)
Cheers

EDIT: I have successfuly sshed to my box.
I am currently in "/etc" and I can see the file "crontab".
But now what do I do?
What did Scott mean by "update_file.sh"?
TIA

mickeybyte

you actually don't need to "cd" to that dir

in fact, you only need to enter the commands like Scott said
so at your shell prompt you type:

update_file.sh /etc/crontab <enter>==> updates the crontab file
update_file.sh /etc/inc/dyndns.class <enter>==> updates the dyndns.class procedure
shutdown -r now <enter>==> reboots the firewall

I think you might as well update the dyndns.class file also before rebooting

So you could have just entered those commands one at a time in the command box using the webinterface (in stead of <enter>you click <submit>)</submit></enter></enter></enter></enter>

rds_correia

Thanks mickeybyte ;).
BTW how is that dyndns service behaving so far?
Cheers

EDIT:

# update_file.sh /etc/crontab
trying to fetch latest /etc/crontab
fetch: http://pfsense.com/cgi-bin/cvsweb.cgi/pfSense/etc/crontab?rev=1;content-type=text%2Fplain: size of remote file is not known
/etc/crontab                                           465  B  110 kBps
# update_file.sh /etc/inc/dyndns.class
trying to fetch latest /etc/inc/dyndns.class
fetch: http://pfsense.com/cgi-bin/cvsweb.cgi/pfSense/etc/inc/dyndns.class?rev=1;content-type=text%2Fplain: size of remote file is not known
/etc/inc/dyndns.class                                   20 kB   44 kBps

This is what I got.
Is this ok?
Cheers

mickeybyte

until now still running fine (fine = not being blocked)

however in the logs it still says every hour cache ip (0.0.0.0) != wan ip (current ip) although it did not change!

Strange I think, because I used to have m0n0wall and I had never any problems with that system.

Nevertheless, I'll keep you informed if my DynDNS account status changes! ;)

sullrich

#1. There was a bug where the cache was being updated every time. Now the cache will not be updated unless it has received a OK status from the provider. So that means your cache statement will be updated as soon as you're ip changes.

#2. We do not use any of the same code for DYNDNS. Erik rewrote ez-ipupdate (which is no longer maintained) to be complete php.

mickeybyte

Great :)

And thanks for support!

rds_correia

Thanks for clarifying this for us Scott.
Cheers

hoba

btw, that also is the reason why the dyndns providerlist of m0n0 and pfsense is different.

mickeybyte

oops :-[, never saw the difference…

mickeybyte

Well, it did last a day longer than before, but there it was again in my mailbox today:
–---Original Message-----
From: DynDNS Support [mailto:support@dyndns.com]
Sent: Thursday, December 15, 2005 3:31 AM
To: <my email="">Subject: Hostname Blocked Due To Abuse

Dear Valued Customer:

The hostname, myaccount.homedns.org, in account myaccount, has been blocked for
abuse. This action has been taken due to the receipt of multiple updates
originating from the same IP address.

Please note, updates which result in the IP address associated with a host
changing are NOT considered abusive. Only those updates which result in no
change to the host are abusive. Please take a moment to review our Update
Abuse Policy here:

http://www.dyndns.com/support/abuse.html

:'(</my>

sullrich

Show us your system logs.

Also show us /etc/crontab

mickeybyte

/etc/crontab:
$ less /etc/crontab
SHELL=/bin/sh
PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin
HOME=/var/log
#minute hour mday month wday who command
0 * * * * root /usr/bin/nice -n20 newsyslog
1,31 0-5 * * * root /usr/bin/nice -n20 adjkerntz -a
1 * 1 * * root /usr/bin/nice -n20 /etc/rc.update_bogons.sh
*/60 * * * * root /usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 sshlockout
1 0-1 * * * root /usr/bin/nice -n20 /etc/rc.dyndns.update

Systemlogs are more difficult, unless you can tell me where I can find them on pfSense (not the webinterface, but the files itself)? Problem is I sent all syslogs tot a syslog daemon, but last night my switch gave up, and I've just repaired the problem, so I don't have any logs in my syslog daemon since late last night. I'll see if I can already find something in there.

sullrich

From a shell:

cat /var/log/system.log | grep Dyn

mickeybyte

looking at the crontab, I've noticed the dyndns line stating
1 0-1 * * * …
what exactly does it mean? when does it run.

I'can only find logfiles on the firewall since I've rebooted it a few hours ago, and there I noticed it updated it every 10 seconds?
In my syslog daemon, I can only find logs until 12 o'clock last night and there it shows up every once an hour, but still not blocked.
The mail that said I was blocked again came around 3h30 this morning

sullrich

The first 1 is first minute. I thought 0-1 is a randomized midnight to 1 am.

I'll change it to run at 1:01 am

Run update_file.sh /etc/crontab again

mickeybyte

Scott,

If you ask me, that's not the best solution.
say, my Ip changes at 4am, it will take until next day 1h01, until my dyndns will get updated? or am I getting it wrong here?

Still can't resist to bring up the CachedIP problem again. That's where the problem is according to me, if it can correctly compare cachedIP and current IP, and only contact dyndns if that's different, what actually does at this time, but cachedIP is always 0.0.0.0.

I'll take a look at the dyndns.class file to see if I can find anything there (not that I'm a freebsd geek, but I do have some programming skills and some linux knowledge)

sullrich

@mickeybyte:

Scott,

If you ask me, that's not the best solution.
say, my Ip changes at 4am, it will take until next day 1h01, until my dyndns will get updated? or am I getting it wrong here?

Still can't resist to bring up the CachedIP problem again. That's where the problem is according to me, if it can correctly compare cachedIP and current IP, and only contact dyndns if that's different, what actually does at this time, but cachedIP is always 0.0.0.0.

I'll take a look at the dyndns.class file to see if I can find anything there (not that I'm a freebsd geek, but I do have some programming skills and some linux knowledge)

The dynamic dns client is run after ANY ip change. The only reason for the once a day check is to check back in after 28 days to keep the item from expiring.

mickeybyte

This is what I found in /var/etc/dyndns.debug:
12-11-05 09:14:42 - (6919068) - [dyndns] - 0.0.0.0/1134330236
12-11-05 10:14:42 - (5357457) - [dyndns] - 0.0.0.0/1134330236
12-11-05 11:14:43 - (2891556) - [dyndns] - 0.0.0.0/1134330236
12-12-05 12:14:42 - (4651791) - [dyndns] - 0.0.0.0/1134330236
12-12-05 01:01:02 - (2923375) - [dyndns] - 0.0.0.0/1134330236
12-12-05 01:14:42 - (4669015) - [dyndns] - 0.0.0.0/1134330236
12-12-05 02:01:02 - (7177439) - [dyndns] - 0.0.0.0/1134330236
12-12-05 02:14:42 - (3299583) - [dyndns] - 0.0.0.0/1134330236
12-12-05 03:14:41 - (4731010) - [dyndns] - 0.0.0.0/1134330236
12-12-05 04:14:45 - (8340914) - [dyndns] - 0.0.0.0/1134330236
12-12-05 05:14:44 - (3307104) - [dyndns] - 0.0.0.0/1134330236
12-12-05 06:14:45 - (9571554) - [dyndns] - 0.0.0.0/1134330236
12-12-05 06:44:44 - (5194273) - [dyndns] - 0.0.0.0/1134330236
12-12-05 07:44:43 - (5387404) - [dyndns] - 0.0.0.0/1134330236
12-12-05 08:44:43 - (5649611) - [dyndns] - 0.0.0.0/1134330236
12-12-05 09:44:42 - (6107681) - [dyndns] - 0.0.0.0/1134330236
12-12-05 10:44:48 - (7788679) - [dyndns] - 0.0.0.0/1134330236
12-12-05 11:44:47 - (4119622) - [dyndns] - 0.0.0.0/1134330236
12-12-05 12:44:47 - (4233917) - [dyndns] - 0.0.0.0/1134330236
12-12-05 01:44:47 - (7404288) - [dyndns] - 0.0.0.0/1134330236
12-12-05 02:44:47 - (6548574) - [dyndns] - 0.0.0.0/1134330236
12-12-05 03:44:47 - (5386367) - [dyndns] - 0.0.0.0/1134330236
12-12-05 04:44:47 - (8115236) - [dyndns] - 0.0.0.0/1134330236
12-12-05 04:44:48 - (8115236) - [dyndns] - abuse
12-12-05 05:44:46 - (9107850) - [dyndns] - 0.0.0.0/1134330236
12-12-05 05:44:47 - (9107850) - [dyndns] - abuse
12-12-05 06:44:46 - (6465648) - [dyndns] - 0.0.0.0/1134330236
12-12-05 06:44:47 - (6465648) - [dyndns] - abuse
12-12-05 07:44:51 - (4552343) - [dyndns] - 0.0.0.0/1134330236
12-12-05 07:44:52 - (4552343) - [dyndns] - abuse
12-12-05 08:44:51 - (4040148) - [dyndns] - 0.0.0.0/1134330236
12-12-05 08:44:52 - (4040148) - [dyndns] - abuse
12-12-05 09:44:51 - (4279538) - [dyndns] - 0.0.0.0/1134330236
12-12-05 09:44:52 - (4279538) - [dyndns] - abuse
12-12-05 10:21:09 - (5411452) - [dyndns] - 0.0.0.0/1134330236
12-12-05 10:21:10 - (5411452) - [dyndns] - abuse
12-12-05 10:21:31 - (3706664) - [dyndns] - 0.0.0.0/1134330236
12-12-05 10:21:34 - (3706664) - [dyndns] - abuse
12-12-05 10:21:34 - (8356999) - [dyndns] - 0.0.0.0/1134330236
12-12-05 10:21:36 - (8356999) - [dyndns] - abuse
12-12-05 10:22:13 - (3049021) - [dyndns] - 0.0.0.0/1134330236
12-12-05 10:22:13 - (3049021) - [dyndns] - abuse
12-12-05 10:22:23 - (1328388) - [dyndns] - 0.0.0.0/1134330236
12-12-05 10:22:24 - (1328388) - [dyndns] - abuse
12-12-05 11:03:22 - (1159591) - [dyndns] - 0.0.0.0/1134330236
12-13-05 12:01:02 - (3816026) - [dyndns] - 0.0.0.0/1134330236
12-13-05 12:03:23 - (9821675) - [dyndns] - 0.0.0.0/1134330236
12-13-05 12:33:22 - (6804676) - [dyndns] - 0.0.0.0/1134330236
12-13-05 01:01:02 - (2003913) - [dyndns] - 0.0.0.0/1134330236
12-13-05 01:33:22 - (8397757) - [dyndns] - 0.0.0.0/1134330236
12-13-05 02:33:21 - (1765254) - [dyndns] - 0.0.0.0/1134330236
12-13-05 03:33:22 - (2963531) - [dyndns] - 0.0.0.0/1134330236
12-13-05 04:33:26 - (9327919) - [dyndns] - 0.0.0.0/1134330236
12-13-05 05:33:26 - (5784744) - [dyndns] - 0.0.0.0/1134330236
12-13-05 06:33:25 - (2334690) - [dyndns] - 0.0.0.0/1134330236
12-13-05 07:33:24 - (1719783) - [dyndns] - 0.0.0.0/1134330236
12-13-05 08:33:25 - (7267097) - [dyndns] - 0.0.0.0/1134330236
12-13-05 09:03:24 - (1136798) - [dyndns] - 0.0.0.0/1134330236
12-13-05 10:03:26 - (8225073) - [dyndns] - 0.0.0.0/1134330236
12-13-05 11:03:26 - (9846324) - [dyndns] - 0.0.0.0/1134330236
12-13-05 12:03:25 - (7372019) - [dyndns] - 0.0.0.0/1134330236
12-13-05 12:33:24 - (7141727) - [dyndns] - 0.0.0.0/1134330236
12-13-05 01:33:29 - (5183041) - [dyndns] - 0.0.0.0/1134330236
12-13-05 02:33:29 - (5446201) - [dyndns] - 0.0.0.0/1134330236
12-13-05 03:33:28 - (4943944) - [dyndns] - 0.0.0.0/1134330236
12-13-05 04:33:28 - (9974256) - [dyndns] - 0.0.0.0/1134330236
12-13-05 05:03:28 - (3564105) - [dyndns] - 0.0.0.0/1134330236
12-13-05 06:03:27 - (5400248) - [dyndns] - 0.0.0.0/1134330236
12-13-05 07:03:27 - (7203522) - [dyndns] - 0.0.0.0/1134330236
12-13-05 08:03:28 - (7083926) - [dyndns] - 0.0.0.0/1134330236
12-13-05 08:03:29 - (7083926) - [dyndns] - abuse
12-13-05 08:33:33 - (8607025) - [dyndns] - 0.0.0.0/1134330236
12-13-05 08:33:37 - (8607025) - [dyndns] - abuse
12-13-05 09:33:32 - (3387273) - [dyndns] - 0.0.0.0/1134330236
12-13-05 09:33:33 - (3387273) - [dyndns] - abuse
12-13-05 10:27:00 - (7111110) - [dyndns] - 0.0.0.0/1134330236
12-13-05 10:27:02 - (7111110) - [dyndns] - abuse
12-13-05 10:27:26 - (3591037) - [dyndns] - 0.0.0.0/1134330236
12-13-05 10:27:26 - (3591037) - [dyndns] - abuse
12-13-05 10:27:29 - (4293309) - [dyndns] - 0.0.0.0/1134330236
12-13-05 10:27:32 - (4293309) - [dyndns] - abuse
12-13-05 10:28:07 - (7443118) - [dyndns] - 0.0.0.0/1134330236
12-13-05 10:28:08 - (7443118) - [dyndns] - abuse
12-13-05 11:00:37 - (9708846) - [dyndns] - 0.0.0.0/1134330236
12-13-05 11:00:38 - (9708846) - [dyndns] - abuse
12-14-05 12:00:36 - (9085216) - [dyndns] - 0.0.0.0/1134330236
12-14-05 12:00:37 - (9085216) - [dyndns] - abuse
12-14-05 12:01:02 - (8895196) - [dyndns] - 0.0.0.0/1134330236
12-14-05 12:01:03 - (8895196) - [dyndns] - abuse
12-14-05 01:00:36 - (7739452) - [dyndns] - 0.0.0.0/1134330236
12-14-05 01:00:37 - (7739452) - [dyndns] - abuse
12-14-05 01:01:03 - (5872394) - [dyndns] - 0.0.0.0/1134330236
12-14-05 01:01:03 - (5872394) - [dyndns] - abuse
12-14-05 02:00:40 - (4460649) - [dyndns] - 0.0.0.0/1134330236
12-14-05 02:00:42 - (4460649) - [dyndns] - abuse
12-14-05 03:00:40 - (8074266) - [dyndns] - 0.0.0.0/1134330236
12-14-05 03:00:41 - (8074266) - [dyndns] - abuse
12-14-05 03:30:41 - (7841892) - [dyndns] - 0.0.0.0/1134330236
12-14-05 03:30:42 - (7841892) - [dyndns] - abuse
12-14-05 04:30:40 - (5952109) - [dyndns] - 0.0.0.0/1134330236
12-14-05 04:30:41 - (5952109) - [dyndns] - abuse
12-14-05 05:30:40 - (7029667) - [dyndns] - 0.0.0.0/1134330236
12-14-05 05:30:41 - (7029667) - [dyndns] - abuse
12-14-05 06:00:39 - (2398307) - [dyndns] - 0.0.0.0/1134330236
12-14-05 07:00:40 - (3043041) - [dyndns] - 0.0.0.0/1134330236
12-14-05 08:00:39 - (5506055) - [dyndns] - 0.0.0.0/1134330236
12-14-05 09:00:40 - (3014221) - [dyndns] - 0.0.0.0/1134330236
12-14-05 10:00:37 - (1297223) - [dyndns] - 0.0.0.0/1134330236
12-14-05 11:00:42 - (5587871) - [dyndns] - 0.0.0.0/1134330236
12-14-05 12:00:42 - (7815354) - [dyndns] - 0.0.0.0/1134330236
12-14-05 01:00:41 - (8702000) - [dyndns] - 0.0.0.0/1134330236
12-14-05 02:00:41 - (6367796) - [dyndns] - 0.0.0.0/1134330236
12-14-05 03:00:41 - (8783922) - [dyndns] - 0.0.0.0/1134330236
12-14-05 03:30:41 - (9664607) - [dyndns] - 0.0.0.0/1134330236
12-14-05 04:30:40 - (6759643) - [dyndns] - 0.0.0.0/1134330236
12-14-05 05:30:40 - (7330136) - [dyndns] - 0.0.0.0/1134330236
12-14-05 06:30:46 - (8976396) - [dyndns] - 0.0.0.0/1134330236
12-14-05 07:30:46 - (6721446) - [dyndns] - 0.0.0.0/1134330236
12-14-05 08:30:46 - (3731522) - [dyndns] - 0.0.0.0/1134330236
12-14-05 09:30:51 - (8441664) - [dyndns] - 0.0.0.0/1134330236
12-14-05 10:30:36 - (2122589) - [dyndns] - 0.0.0.0/1134330236
12-14-05 11:30:35 - (7019757) - [dyndns] - 0.0.0.0/1134330236
12-15-05 12:01:03 - (2048596) - [dyndns] - 0.0.0.0/1134330236
12-15-05 12:30:36 - (9360039) - [dyndns] - 0.0.0.0/1134330236
12-15-05 01:01:03 - (6270883) - [dyndns] - 0.0.0.0/1134330236
12-15-05 01:30:35 - (9418419) - [dyndns] - 0.0.0.0/1134330236
12-15-05 02:30:34 - (6853193) - [dyndns] - 0.0.0.0/1134330236
12-15-05 03:30:37 - (8088756) - [dyndns] - 0.0.0.0/1134330236
12-15-05 04:30:38 - (1488027) - [dyndns] - 0.0.0.0/1134330236
12-15-05 04:30:39 - (1488027) - [dyndns] - abuse
12-15-05 05:30:37 - (1156730) - [dyndns] - 0.0.0.0/1134330236
12-15-05 05:30:38 - (1156730) - [dyndns] - abuse
12-15-05 06:30:35 - (1208572) - [dyndns] - 0.0.0.0/1134330236
12-15-05 06:30:36 - (1208572) - [dyndns] - abuse
12-15-05 07:30:39 - (8267492) - [dyndns] - 0.0.0.0/1134330236
12-15-05 07:30:40 - (8267492) - [dyndns] - abuse
12-15-05 08:30:38 - (7514137) - [dyndns] - 0.0.0.0/1134330236
12-15-05 08:30:41 - (7514137) - [dyndns] - abuse
12-15-05 09:30:39 - (5583750) - [dyndns] - 0.0.0.0/1134330236
12-15-05 09:30:40 - (5583750) - [dyndns] - abuse
12-15-05 10:30:38 - (7945971) - [dyndns] - 0.0.0.0/1134330236
12-15-05 10:30:38 - (7945971) - [dyndns] - abuse
12-15-05 11:30:36 - (2149134) - [dyndns] - 0.0.0.0/1134330236
12-15-05 11:30:37 - (2149134) - [dyndns] - abuse
12-15-05 12:30:40 - (6524642) - [dyndns] - 0.0.0.0/1134330236
12-15-05 12:30:41 - (6524642) - [dyndns] - abuse
12-15-05 01:30:39 - (7896830) - [dyndns] - 0.0.0.0/1134330236
12-15-05 01:30:40 - (7896830) - [dyndns] - abuse
12-15-05 02:30:38 - (3340408) - [dyndns] - 0.0.0.0/1134330236
12-15-05 02:30:39 - (3340408) - [dyndns] - abuse
12-15-05 03:30:42 - (7449804) - [dyndns] - 0.0.0.0/1134330236
12-15-05 03:30:43 - (7449804) - [dyndns] - abuse
12-15-05 04:30:46 - (6812999) - [dyndns] - 0.0.0.0/1134330236
12-15-05 04:30:47 - (6812999) - [dyndns] - abuse
12-15-05 05:30:45 - (9706623) - [dyndns] - 0.0.0.0/1134330236
12-15-05 05:30:46 - (9706623) - [dyndns] - abuse
12-15-05 06:08:25 - (3152146) - [dyndns] - 0.0.0.0/1134330236
12-15-05 06:08:27 - (3152146) - [dyndns] - abuse
12-15-05 06:08:29 - (6411514) - [dyndns] - 0.0.0.0/1134330236
12-15-05 06:08:40 - (6411514) - [dyndns] - abuse
12-15-05 06:08:43 - (6894303) - [dyndns] - 0.0.0.0/1134330236
12-15-05 06:08:44 - (6894303) - [dyndns] - abuse
12-15-05 06:09:01 - (3310163) - [dyndns] - 0.0.0.0/1134330236
12-15-05 06:09:01 - (3310163) - [dyndns] - abuse
12-15-05 06:23:29 - (2898009) - [dyndns] - 0.0.0.0/1134330236
12-15-05 06:23:31 - (2898009) - [dyndns] - abuse
12-15-05 06:24:18 - (1482317) - [dyndns] - 0.0.0.0/1134330236
12-15-05 06:24:21 - (1482317) - [dyndns] - abuse
12-15-05 06:40:59 - (8417336) - [dyndns] - 0.0.0.0/1134330236
12-15-05 06:41:00 - (8417336) - [dyndns] - abuse
12-15-05 06:41:31 - (7819280) - [dyndns] - 0.0.0.0/1134330236
12-15-05 06:41:32 - (7819280) - [dyndns] - abuse
12-15-05 06:48:29 - (3020094) - [dyndns] - 0.0.0.0/1134330236
12-15-05 06:48:29 - (3020094) - [dyndns] -
12-15-05 06:48:40 - (4232711) - [dyndns] - 0.0.0.0/1134330236
12-15-05 06:48:40 - (4232711) - [dyndns] -
12-15-05 06:48:51 - (1028691) - [dyndns] - 0.0.0.0/1134330236
12-15-05 06:48:51 - (1028691) - [dyndns] -
12-15-05 06:49:03 - (7385844) - [dyndns] - 0.0.0.0/1134330236
12-15-05 06:49:03 - (7385844) - [dyndns] -
12-15-05 07:45:05 - (2353015) - [dyndns] - 0.0.0.0/1134330236
12-15-05 07:45:06 - (2353015) - [dyndns] -
12-15-05 07:50:22 - (2752449) - [dyndns] - 0.0.0.0/1134330236
12-15-05 07:50:24 - (2752449) - [dyndns] - abuse
12-15-05 07:50:26 - (6615088) - [dyndns] - 0.0.0.0/1134330236
12-15-05 07:50:26 - (6615088) - [dyndns] - abuse
12-15-05 07:50:46 - (3027218) - [dyndns] - 0.0.0.0/1134330236
12-15-05 07:50:47 - (3027218) - [dyndns] - abuse
12-15-05 07:50:56 - (5291978) - [dyndns] - 0.0.0.0/1134330236
12-15-05 07:50:56 - (5291978) - [dyndns] - abuse

seems like it is updatin every hour, of half an our. This could be related to my DHCP renewal time. Sometimes it's 1800 seconds, other times it's 3600 seconds.
however, I seem to always get the same IP address on every renewal.

I'll look further into the script.