Website blocked because IP address is listed as BAD

[#1]

I have been normally able to connect to my work website and servers without issue. Last week I started to loose connection and reseting router was only solution. Thgis worked for a few hours or minutes (random lengths of time) and then I was again blocked. The site is question is the University of Liverpool and the IT people there tell me that every one of the IP addresses assigned so far to my router by Plusnet are on a SPAMHAUS or similar BLACKLIST.  I've check this myself and find this is so. Even immediately after reseting the router and getting a new IP the IP is listed as bad there. Due to the tight security that is used at the University, which they will not and cannot change, as it can affect student futures, I'm stuck.

I have run Deep virus scans on all my machines, (One wireless laptop and one connected PC) without any issues. I have done a tracrt to the University and get as far as the University servers. I have had a static IP assigned and the was also listed on SPANHAUS so made matters worse as it would not change on a reset. The local pool of IP address does not give me muck scope for finding an IP address that is not flagged bad and if I do when this replaced later with a new one there is no gaurantee that that one will be clean.

Have Plusnet been bying new BAD IP addressess?  When checked they all came back as being PLUSNET UK as the owners.

What the devil do I do now?

[#2]

@jimathome Welcome to the forums. I'm no great expert on this subject, but have seen this situation before, and it is usually due to the incorrect application of 'blacklists' by organisations - in this case, your employers. Most public IPs are on such lists, but usually, AIUI only so that they are prevented from being used as mail relay options.

Hopefully, one of the more 'clued-up' Community members or PN staff will give you a better explanation, but this honestly sounds to me like someone has incorrectly interpreted the use of SPAMHAUS,  or other similar, list.

Can you post the result of your test, but obscure the last octet of your address? FYI, Plusnet do not buy 'BAD' addresses.

[#3]

The key question here is which Spamhaus list are the IP's on? Spamhaus maintain a PBL list; its purpose is for identifying IP's that have been dynamically assigned by ISP's. For this reason, I would fully expect to see the majority of Plusnet's (and the majority of other consumer ISP's, and thus students of the University's) IP addresses listed.

Presence on the PBL list does not mean an IP address is 'bad'.

If we're talking about some other list, then the above may not be relevant. If I'm on the right track though, then the University's IT staff are not as informed as they could be

[#4]

Thanks for the concise answer @bobpullen - I think that was what I should have said, but I was trying to be too clever.

[#5]

Yes its the PBL and I was thinking exactly the same thing. I can't see why any if the PLUSNET IPs should not be on the SPAMHAUS PBL list. The problems here as always are !) why suddenly did it change (IP address reassigned on new lease? No power cycle etc of router though) and 2) both sides (PLUSNET and THE UNIVERSITY) both blame the other for the issue. I am of the opinion that it is the University who are being too agressive with their filtering. It's very difficult to get past the initial people on the helpdest though.

Assuming it's not a SPAMHOUS issue thats causing the problem any other reasons the uni would suddenly start to block a working IP source? As I say my network monitor shows no strange activity, I have no viruses on my PCs and I can't even PING the university server IP address.

[#6]

Hi jab1, and thanks for your help which was remiss of me mention .

Attached MX blocklist scan of IP address. All are clear except SPAMHAUS ZEN

Cheers

[#7]

From what you say above, it is the UoL who have misapplied the PBL for some reason, but if you can't get to talk to anyone in authority, you aren't going to get far. If you are on a dynamic IP, they can change at lease renewal, although as they are allocated from small 'local' - to your exchange - pools, they very often don't.

It sounds like the university has made a mistake, but like all big organisations, they are unlikely to admit it.

NB - I am not defending PN here, just pointing out the issue, as I see it.

[#8]

@jimathome - If that is the list they are working from, I think someone needs retraining, but I'll leave it to @bobpullen to pass informed opinion as I don't have sufficient in-depth knowledge.

Double-checking, and they certainly do - that is only for checking mail-servers.

[#9]

Thanks John,

I agree with everything you say. Because of the security issues it isn't as clear cut for me to find out which blocklists they use. This doesn't help but I hopefully can try again to persuade them to look harder at this. SPAMHAUS was the list that was used as the reason initially by their IT man.

They have a web based helpdesk that is interactive for faults but this is also not accepting input ftrom me anymore. I can feel aheated phone call coming on.

Jim

[#10]

Just a quick Update - The University have now apparently escalated the case to their network security team. I'll let you know the outcome. Fingers crossed.

Jim

[#11]

The latest is that the University have allowed my current IP address access and they are now looking at the methods they use for the security checking of connections. Seems others have been having similar problems. They seem so confident of the fix that they have RESOLVED my ticket on their system already!

Thanks for your support with this having others back up your theories helps get presure in the right places.

Regards

Jim

[#12]

Sounds like an obliqie way of saying 'oops, we are possibly doing something wrong' - but maybe not. 😉