Strange routing issue - unable to access main Plusnet servers

[#1]

@jelv - Did you get this resolved?

[#2]

Nope - security are apparently refusing.

Somewhat annoying when it's pretty certain as you posted it was down to an issue on their side anyway!

[#3]

I have also just resolved an issue where I couldn't access plus.net. I too was the subject of a firewall rule that blocked access from my IP address. I'd tried to sign up to PlusNet mobile, but the web page locked up (repeatedly). It seems that it redirected to the same page, and effectively resulted in what PlusNet viewed as a DoS attack.

I only found out by accident yesterday, but the block had been in force since December. The block was lifted today after a long telephone call yesterday, after a loooong wait in the queue.

Having thought about this, and after discovering that it is a relatively common problem, and one that is caused by PlusNet's own web scripts, I'm increasingly unhappy with this!

[#4]

You know @jelv that is truly appalling behaviour from Plusnet, would someone care to comment on why this attitude is being adopted, what is the justification for this? @Chris @scrookes You may no longer be a customer of Plusnet but you are a valued member of the Forum. This stinks.

[#5]

@Anonymous, it is not intentional. Much of the intrusion detection is appliance-handled/automated and it's worth noting that  it typically gets things right. 

We have an incident raised about the recursive 301 redirects (ref: 96169) and our engineers are investigating. Hopefully won't be an issue for too much longer.

@jelv, there seems to be some reluctance around unblocking due to the sustained nature of the traffic from your IP. Whilst I've not seen it first-hand, I'm led to believe it doesn't fit the signature of the 301 redirect issue and has been happening for some time now. I'll try and do some digging and see if I can get some info that we can both work with to pinpoint the cause.

Rest assured there's nothing sinister behind the decision.

[#6]

Hi @bobpullen I thanks for the response it's appreciated and from your comment to @jelv I can understand the reluctance to lift the block. However, would it not have been more practical to have had the guys in the NOC do this digging themselves in an attempt to resolve the issue for both themselves and Jelv. Without jelv knowing there was illicit traffic coming from his machine how is he expected to fix it. After all by blocking the user they are only treating the symptom and not the cause.

[#7]

I think you may be under-estimating the volume of blocking devices like this do. It's simply not practical to have a human investigate every instance. Remember that jelv now has a non-Plusnet IP so even if we had seen the block, it's unlikely we'd have attributed it to him.

[#8 · Accepted solution]

@jelv, give things another shot the next time you get the opportunity. All being well, you should be able to get through.

[#9]

Thanks @bobpullen

I actually realised something had changed before I saw your message as Thunderbird popped up to say it had just received 100+ emails from the mailbox I still have which is linked to these forums.

[#10]

The firewall block on my account was reinstated last night - an internal "question" on my account notes 40,000 hits in 30 minutes.

Again I was not notified, and again I had to spend >30 minutes waiting for the help desk to answer and then some time to remove the block.

After the last time I started logging all outgoing connections (I have >200MB of log files form the last few weeks). However, I don't see anything suspicious in those - of course if I had details of the IP address being "hit" and the time I may be able to identify the originating device.

Anyway, in the 2 hours before the message was added to my account there were less than 5000 outgoing connections made, so I'm not sure how the 40,000 hits happened. Also the overall outgoing traffic over that period averaged 200bytes/sec,which doesn't seem enough for >10,000 hits a minute.

Rather than providing me with some information that would help prevent the situation reoccurring, support made me reboot my router.

BTW the block prevents access to John Lewis Broadband sites as well as Plusnet, which is how I noticed the block was in place again.