LF_SPI requires disabling on restored Server

[darnoldcs]

Hi All,

Been scratching my head with this one, hopefully someone can shed some light.

We have a Centos 7 (cPanel) bare metal Dedicated server running CSF without issue.

A restore of this box was done to an alternative server from an Acronis backup. IP changed etc.

Now on the new server there is issues with port 80 and 443 being blocked and eventually figured out that disabling LF_SPI allows traffic to through.

We have never had this issue on other servers and LF_SPI is enabled on the original server.

Does anyone know why we might be seeing this?

Regards,
Dave

[Sergio]

Please post a blocked note to see what is wrong.

Sergio

[darnoldcs]

Hi Sergio,
Can you explain what you mean by a blocked note?

[Sergio]

Do you receive any message from the server about this issue?
Or, Have you checked on all the logs some info about this?

Any log line will help.

Sergio

[darnoldcs]

Hi Sergio,
Unfortunately we where not seeing anything in CSF logs to point to the issue which made identification so difficult.

However the culprit was finally discovered to be ESET Security Server. In particular the Web Access Protection feature. As soon as this was disabled CSF functioned again as normal.

Dave

[Sergio]

Great!
Good to know that ESET can cause this issue, wrote this on my own notes for a future reference, thanks.

Sergio