Everything works, except one single website!?!
-
[edit]
Possibly an ISP is blocking it if you are in the UK[/edit], snort also blocks its for java obfuscation above level 1, and for some strange reason the ip address is already in my block list and yet I have not visited your site until a few moments ago. How strange!Edit. If an isp was blocking it I wouldnt be able to see it.
For a static Akami Technologies webserver to be blocked already is interesting along with what you have said noobie.
-
That IP is blacklisted by 'Virus Total' : https://www.robtex.com/en/advisory/ip/208/109/181/92/
-
That IP is blacklisted by 'Virus Total' : https://www.robtex.com/en/advisory/ip/208/109/181/92/
So one possible explanation is its a phishing exercise if one is cynically mind, considering the new account.
Edit.
Check your WAN logs after the visit, you'll notice an increase of incoming traffic from a variety of ip addresses, of course the geolocation of source ip's is not indicative of the culprit, it could be a bot net designed to set others up, thats what makes life interesting. Smoke & Mirrors. ;D -
Its been educational. ;D
-
Derelict: It absolutely is PFsense since the only variable that's consistent is PFsense. I can change the DNS settings, use different computers, different browsers, different devices, etc. The second I get PFsense out of the way it pulls the site up instantly. Does PFsense keep cache files of websites or DNS data? (even though the PFsense server isn't running DHCP or DNS, those both run on a Windows machine, which works fine if I bypass PFsense, but it doesn't work if I bypass the windows box and leave PFsense in the chain).
You can wank about it being pfSense all you want. It might be your misconfiguration of the same, but it's not something systemic with the software. I certainly cannot find the Block access to this single website checkbox.
You say it's your spouse's work? Do you VPN in or anything? Some other reason you would have DNS for that site hosed?
And the site only shows "Find us on Google+" to those who browse with javascript disabled ala NoScript. Completely a browser issue, nothing to do with routing or the pfSense software. I won't comment on the audacity of playing music without warning.
-
That IP address resolves to a GoDaddy server hosting a variety of sites.
At least a few raise questions as to their "integrity".pottingerphoto.com is registered to an Australian owner through Yahoo.
Assuming the best - the owner of pottingerphoto.com created a site and hosted it on a "cheap" GoDaddy server that's gotten blacklisted due to other clients on the same server.
Assuming the worst - it's a phishing/malware/social engineering attempt.
Either way, it's not a pfSense problem.
-
And no, if you didn't actually see a functional website without having to click anything then it didn't really work.
I won't click random flash shit, sorry. It is accessible just fine from behind pfSense. The Flash is blocked by my browser by default (click to play). Has nothing to do with pfSense. My interest in the contents of sites unusable without flash is absolutely zero. (BTW, same can be said about search engines, perhaps you could forward this message to your wife. There are also people who refuse to install buggy Adobe junk that gets tens of security advisories every month, or people where Flash is not available at all on their platform.)
Plus, as noted above, this whole thread starts to stink.
-
Works fine for me behind 2.2.2 after pausing to load that massive Flash blob.
-
:D
And you guys are getting tricked into this everytime :D
-
Its not a phishing attempt, though apparently using godaddy isn't quite the good idea I thought it was. I'd be happy to hear of some hosts that don't suck quite so badly. The IP address shouldn't show as owned by someone in aulstralia, it should show as Kentucky, USA. In fact, your welcome to look up the LLC on kentucky's .gov website, the business has been active for 10+ years now I believe.
The website is a template, and not one i'm fond of. It does show a non-flash version to devices that don't support flash (otherwise it wouldn't work on an iPad for example).
Its also clearly something wrong with PFsense, but that definitely doesn't mean its not a configuration issue of some kind I've caused. In fact I'd say it most likely is a configuration issue of some kind based on the fact that many of you have gotten it working (other then the noscript/Ihateflash confusion).
Hopefully a reinstall fixes it.
-
Its not a phishing attempt, though apparently using godaddy isn't quite the good idea I thought it was. I'd be happy to hear of some hosts that don't suck quite so badly. The IP address shouldn't show as owned by someone in aulstralia, it should show as Kentucky, USA. In fact, your welcome to look up the LLC on kentucky's .gov website, the business has been active for 10+ years now I believe.
The IP of the web server shows up under GoDaddy's Arizona HQ address, which would be expected. That's a shared hosting service, the IP isn't assigned only to that company, and even if it were it's just a single address out of one of GoDaddy's blocks.
The domain is registered with registrar Melbourne IT Ltd in Australia, but registered to Ben Pottinger in KY as the owner.
All cheap website hosting sucks. You'll end up on a server with hundreds or thousands of other websites, likely some of ill repute or some that get compromised and become of ill repute. That IP in particular hosts 1001 different domains. Can look up the IP here. http://www.yougetsignal.com/tools/web-sites-on-web-server/
There really isn't anything you can do to get great low-rent web hosting. I'm sure there are some providers that are better than GoDaddy, but don't expect any ~$10-20/month or less web hosting to be great.
Back to the original problem - what's failing? Does DNS resolve correctly? Can you ping the IP? If DNS resolves fine, and you can't ping the IP, what does a traceroute to that IP look like?
-
-
Btw: strange, that site "Find us on Google+" and nothing more …..
Very strange…. what does it show up?
-
I'm totally lost here. I've been running PFsense for years without issues and now, recently, I can't access my wifes business website. None of the 5+ computers in the house will access the website. My phone, using verizons 4G can access the website. My primary PC can access the website when using a VPN. My friends can access the website. I can access the website (again, primary PC, and probably all the others) if I bypass the PFsense router and plug directly into time warner. It doesn't seem to be a DNS issue (ive tried my local DNS server, Google DNS, and OpenDNS and timewarners DNS).
I updated the PFsense server from 2.02 to the newest (2.2.2) AFTER having these problems, hoping that the update would fix the issue. I've cleared DNS (flushDNS) on all the local machines to no avail.
The website is www.pottingerphoto.com
the error chrome is giving me is: This webpage is not available ERR_CONNECTION_TIMED_OUT
"Google Chrome could not load the webpage because pottingerphoto.com took too long to respond. The website may be down, or you may be experiencing issues with your Internet connection."The website is hosted through godaddy and the DNS name is hosted through Yahoo domains (yuck!). But it doesnt seem to be an issue on their end since it works fine anywhere and everywhere except behind my PFsense box.
I cleared all NAT and firewall rules I had created and that also didn't seem to help.
netflix works, amazon works, all google services work, Steam and steam games work, P2P services/websites all work, every website I can think of and try works except this one!
Its clearly a PFsense issue because if I pull PFsense out of the chain the site works fine. I love the overall reliability of PFsense so i'm really hoping someone has a fix for this so I don't have to dump PFsense.
Let me know what additional information might be needed.
I have exactly the same problem recently with the webconfigurator of pfsense, in HTTPS. Still don't find the solution, but I know it is related to chrome and firefox, because I can access on http on edge. Still searching for the solution…
-
First page load on some websites will throw the error that the "Site cannot be reached" - but within a few seconds will usually load on it's own. Sometimes if I refresh a few times it will also load. I have checked logs, disabled/removed squid/squidGuard. I verify DNS from local machine does a lookup fine on the name.
I have "Clear invalid DF bits instead of dropping the packets" checked in Adv->Firewall/NAT, also Disable Firewall Scrub is checked and I set Firewall Optimization to 'conservative' (per a few articles I've found)pfSense is my DNS server - I have several VLANs - have tried a couple of them and exhibit same behavior on same site.
(CNN.com for example will give ERR_CONNECTION_RESET and "This site can't be reached" on GUEST wifi as well as Private wired)
I have combed thru firewall rules - but nothing stands out. And I'd assume if it is blocked it would stay blocked instead of letting traffic pass after initial load.
There does seem to be a difference in behavior from mobile on Wifi vs Wired PC tho. On mobile - cnn.com won't load at all - after several refreshes still fails. On PC wired, it auto-loaded within a couple seconds of the initial failure. Also on PC seems once it loads it's ok it seems to work after tha -
This post is deleted!
