ConfigServer Community Forum

I first noticed these two issues after an auto-upgrade to 4.02, and they persist in 4.04.

1. Global allow rules not being updated
I have a GLOBAL_ALLOW url specified in my configuration file. Upon CSF/LFD initialization (or manual restart), these rules are applied correctly:

[INDENT]Chain GALLOW (2 references)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT tcp -- eth+ * 216.239.32.0/19 0.0.0.0/0 tcp dpt:25
2 0 0 ACCEPT tcp -- eth+ * 64.233.160.0/19 0.0.0.0/0 tcp dpt:25
3 0 0 ACCEPT tcp -- eth+ * 66.249.80.0/20 0.0.0.0/0 tcp dpt:25
4 0 0 ACCEPT tcp -- eth+ * 72.14.192.0/18 0.0.0.0/0 tcp dpt:25
5 0 0 ACCEPT tcp -- eth+ * 209.85.128.0/17 0.0.0.0/0 tcp dpt:25
6 0 0 ACCEPT tcp -- eth+ * 66.102.0.0/20 0.0.0.0/0 tcp dpt:25
7 0 0 ACCEPT tcp -- eth+ * 74.125.0.0/16 0.0.0.0/0 tcp dpt:25
8 0 0 ACCEPT tcp -- eth+ * 64.18.0.0/20 0.0.0.0/0 tcp dpt:25
9 0 0 ACCEPT tcp -- eth+ * 207.126.144.0/20 0.0.0.0/0 tcp dpt:25[/INDENT]

However, as soon as the first LF_GLOBAL auto-update interval occurs, the rules are all removed:

[INDENT]Chain GALLOW (2 references)
num pkts bytes target prot opt in out source destination[/INDENT]

When this happens, the LFD log still shows a normal message:
[INDENT]lfd: Global Allow - retrieved and allowing IP address ranges[/INDENT]

2. DYNDNS addresses being denied access in some instances
I have a server IP address listed in csf.sips. In previous versions, access to this IP was still granted to both DYNDNS addresses and source IP addresses specified in csf.allow.

However, in the current version, DYNDNS addresses are now blocked to this destination, while sources in csf.allow are still allowed through.

While this may not be a bug in and of itself, I feel that for the sake of consistency, one of the following should happen when IP addresses are listed in csf.sips:

• DYNDNS and csf.allow sources should both be allowed through (preferably, as this was the behavior in previous versions), or
• DYNDNS and csf.allow sources should both be blocked

You really do an outstanding job of maintaining this product...thanks so much for the amount of time you invest in it!

I'll address the DYNDNS and SIPS issues in the next release.

I am unable to reproduce the GALLOW issue at present (it's working OK for me).

For the GALLOW issue, do check in /usr/local/apache/logs/error_log that mod_security isn't blocking the connection.

I've found the GALLOW/GDENY problem and will work on a fix.

All of these issue should now have been addressed in v4.06 which I've just released.