Curious Networking issue on home web server

[#1]

I have a small web server that has been running flawlessly for years on a 80/20 fibre connection with a static IP address, until midday today when the response time for external inbound connections has gone from a reliable 280 milliseconds (I monitor it on www.uptimerobot.com) to 5+ seconds (but sometimes normal), making the site more or less unusable.

The web server response times are normal speeds on the internal network. 

Broadband speed test show download/upload working at normal speeds

Nothing has been changed, beyond turning off everything except my desktop (on which the web server resides), the router and the BT fibre modem.

Server and router rebooted.

Everything is normal except the external inbound connection response times.

Plusnet support are seeing everything as normal. No restrictions.

Plusnet support says you guys are cleverer than them... so here goes: Any ideas?

 PS The static IP address externally produces the same symptoms, so it's not DNS.

[#2]

And the site is called?

Who provides your DNS servers?

[#3]

To cut out the DNS layer, the ip address is 212.159.68.138

That will default to error_page.html that just contains the text "Not Found".

Refresh that a couple of times and you should see the problem.

[#4]

I tried a rapid download Linux command:-

wget 212.159.68.138
--2018-10-01 17:20:45--  http://212.159.68.138/
Connecting to 212.159.68.138:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: http://212.159.68.138/error_page.html [following]
--2018-10-01 17:20:52--  http://212.159.68.138/error_page.html
Reusing existing connection to 212.159.68.138:80.
HTTP request sent, awaiting response... 200 OK
Length: 18 [text/html]
Saving to: ‘index.html’

index.html                  100%[=========================================>]      18  --.-KB/s    in 0s      

2018-10-01 17:20:52 (1.09 MB/s) - ‘index.html’ saved [18/18]

Note that it took 7 seconds to download virtually nothing - just 18 bytes on a 70/20 Mbit/sec connection.

BTW Your DNS address reveals what looks like:- 'username.plus.com'

[#5]

Mmmm, but why so slow on just inbound connections?

Re username.plus.net. Hilarious isn't it. Plusnet wouldn't change it... Anyway I have other domains that point here (I didn't want to promote them here and it's all password protected anyway).

[#6]

Have you tried temporarily disabling your Windows Firewall ?

* edit - assuming you're on a Windows machine and it has the firewall enabled of course *

[#7]

It's Fedora, and yes it does have a firewall(! ). It's got to the point that I'll try anything!

[#8]

Maybe also run a tail -f /var/log/apache/whateveritscalled.log  to see if you can see in real time what is coming through as a request - maybe the request is hitting quickly but the reply is taking time.

[#9]

I also find iptraf useful on my Ubuntu servers to see what is hitting my machine and when. Not sure on other flavours of Linux but maybe worth a look.

[#10]

Update: Thanks for those suggestions. It looks like it might be a type of Slowloris DDOS attack, with IP addresses around the world (hosting companies and VPNs) generating about 50 connections each that didn't do much. The command line I used to get the connection info is at the end of the post, should someone find it useful. I'm going to install a Draytek router that I have lying about to try and filter out the problematic IP addresses (probably a thankless task as there are so many of them) and then disable firewalld and use iptables to drop anything with more than 20 connections. Unless anyone has a better idea...?

netstat -ntu -4 -6 |  awk '/^tcp/{ print $5 }' | sed -r 's/:[0-9]+$//' |  sort | uniq -c | sort -n

[#11]

I get the same - port scans, probes, email hacking attempts etc etc.

I can't stop people getting past the router but I use fail2ban for any services I'm running - if anybody tries more than 3-4 times to access something they shouldn't, it puts an automatic ban on using iptables.