It is currently Fri Dec 14, 2018 1:33 am

All times are UTC [ DST ]




 Page 1 of 1 [ 11 posts ] 
Author Message
 Post subject: [Help Connection] Too many insecure sites in this netblock.
PostPosted: Sun Feb 23, 2003 5:51 am 

Joined: Sat Feb 22, 2003 1:47 am
Posts: 1
Hi
Well, I did a bit of research and emailed my ISP. This is what they said:

Unfortunatley as this block has been setup by the remote hosts we are unable to resolve this problem. We do not have record of being contacted by the person(s) who have setup this block nor do we have enough information to acertain if the block was setup by one specific server or set across all servers. There is also no contact information available for us to discuss this matter with who ever has blocked our network.

For this block to be lifted the person(s) responcible for the block will need to email us at abuse@optusnet.com.au so we can discuss the problem.

Whats going on???? Why are blocked????? :cry:


Offline
 Profile  
 
 Post subject:
PostPosted: Mon Feb 24, 2003 10:12 am 
User avatar

Joined: Fri Mar 01, 2002 1:00 am
Posts: 209
Location: Barcelona, Spain
Hello sarinoua. Since the Undernet offers a free service, i.e. costing nothing, it has to protect their guests and their resources. The Undernet scans connections for insecure/open/misconfigured proxys or alike (wingate, squid, etc) to prevent abuse over the network.

Misconfigured or open proxys are globally banned (G-lined) from the network for a certain amount of time to let the user fix the problem. However, if too many hosts or recidivism from the same Ip block are detected as having the same problem, the ban will apply wider and longer.

Once your ISP has checked and fixed all these situations in their domain, they have to contact abuse@undernet.org and confirm it will not happen again. If they want further details to track down a customer who is abusing Undernet resources, use the above email too.

All my best

cArLiLLoS
Undernet User Committee member
http://www.user-com.undernet.org
user-com@undernet.org


Offline
 Profile  
 
 Post subject:
PostPosted: Tue Mar 04, 2003 1:26 pm 

Joined: Tue Mar 04, 2003 1:16 pm
Posts: 14
Location: Australia
cArLiLLoS wrote:
Hello sarinoua. Since the Undernet offers a free service, i.e. costing nothing, it has to protect their guests and their resources. The Undernet scans connections for insecure/open/misconfigured proxys or alike (wingate, squid, etc) to prevent abuse over the network.

Misconfigured or open proxys are globally banned (G-lined) from the network for a certain amount of time to let the user fix the problem. However, if too many hosts or recidivism from the same Ip block are detected as having the same problem, the ban will apply wider and longer.

Once your ISP has checked and fixed all these situations in their domain, they have to contact abuse@undernet.org and confirm it will not happen again. If they want further details to track down a customer who is abusing Undernet resources, use the above email too.

All my best

cArLiLLoS
Undernet User Committee member
http://www.user-com.undernet.org
user-com@undernet.org


which of course is a waste of time as Optus cannot track where the issue lies as you have not given them the information - basically you have it seems added the entire optusnet block to this list thus one of the major australian ISP's is blocked - this is an ISP that will disconnect users found running servers or insecure proxies on their network if they are reported. Basically we are aware its a free service but when we can no longer connect to our Undernet channels thanks to this sort of one bad all bad rubbish its a bit rankling - especially as we can still connect to dalnet and other networks.

is there ANY chance that Optus customers can possibly reconnect to your service in the near future ? I loved the suggestion of one user to get a new ISP - may i suggest a visit to lovely Australia where we pay thru the nose to even get decent access and changing ISP's, especially on cable, is a costly and expensive exercise.

From what i can see undernet have simply decided bad luck if theres one scum bag on the network you are all in trouble - funny thing is Austnet have had to ban chello and a number of european networks due to abuse - wonder what would happen if you banned BT or one of the major european nets ?

Is there an Australian Server that will actually still allow australian clients to connect ? or is that too much to ask - basically the way i see it is we are SOL if we expect this to be solved yet we who have aussie IRC servers spend our time kicking abusers and packet flooders from european servers without ever resorting to this heavy handed action.

Yes im upset - 7 years using undernet and 3 of them with Optus and never have i seen this sort of thing before - this used to be one of the best IRC nets on the web.. Now im not sure what its becoming

EDIT : if you have an issue with an isp then email them - optus is abuse@optushome.com.au and its not hard to do - expecting the ISP to contact you is somewhat pointless as theyre not going to know that you have done it until they have a whole pile of hello off customers - if you have proof then email the ISP the proof BEFORE applying this sort of block ban.

EDIT 2: Oh and i have checked - not one single server will allow an ONC connection to it - same message every time - this of course on an ISP where getting a new IP address is a major exercise ... Bascially we are screwed

Moderator / Undernet Staffers please confirm that with this block ban all Optusnet Customers are NO LONGER WELCOME ON UNDERNET SERVERS ?

If this is the case make a forum post to that effect - may i also suggest that instead of applying these block bans in private that they also be listed in the forums so people can be made aware of the blocks being placed on their ISP.s Id also like to see how many attacks on undernet servers have come from Australian ISP's ? in fact id REALLY like to see that one.


Offline
 Profile  
 
 Post subject:
PostPosted: Tue Mar 04, 2003 4:50 pm 
User avatar

Joined: Fri Mar 01, 2002 1:00 am
Posts: 209
Location: Barcelona, Spain
eviltwin wrote:
which of course is a waste of time as Optus cannot track where the issue lies as you have not given them the information - basically you have it seems added the entire optusnet block to this list thus one of the major australian ISP's is blocked - this is an ISP that will disconnect users found running servers or insecure proxies on their network if they are reported. Basically we are aware its a free service but when we can no longer connect to our Undernet channels thanks to this sort of one bad all bad rubbish its a bit rankling - especially as we can still connect to dalnet and other networks.


G-lines are set for a certain amount of time on every individual IP as found abusing the network, whether clones, proxys, flooders, etc. However, if recurrent abuse is found as coming from many hosts within an IP block, i.e. ISP domain, the ban will apply wider and longer.

Quote:
is there ANY chance that Optus customers can possibly reconnect to your service in the near future ? I loved the suggestion of one user to get a new ISP - may i suggest a visit to lovely Australia where we pay thru the nose to even get decent access and changing ISP's, especially on cable, is a costly and expensive exercise.


Certainly it's not our concern how ISPs make money with the service we offer. Undernet, though, has to protect their valuable resources and guests, so we have to ban abusers and try to keep them away from our network as far as possible.

Quote:
From what i can see undernet have simply decided bad luck if theres one scum bag on the network you are all in trouble - funny thing is Austnet have had to ban chello and a number of european networks due to abuse - wonder what would happen if you banned BT or one of the major european nets ?

Is there an Australian Server that will actually still allow australian clients to connect ? or is that too much to ask - basically the way i see it is we are SOL if we expect this to be solved yet we who have aussie IRC servers spend our time kicking abusers and packet flooders from european servers without ever resorting to this heavy handed action.


Last time I checked (some minutes ago) I could see many users from *.optusnet.com.au domain being connected to the Undernet. Try again, please.

Quote:
Yes im upset - 7 years using undernet and 3 of them with Optus and never have i seen this sort of thing before - this used to be one of the best IRC nets on the web.. Now im not sure what its becoming


We deeply apologise for the inconveniences but in the meantime, we hope users understand we do our best to be as much accurate as possible when banning these lamers. We lack of resources, either human or technical, to contact every single domain we ban due to the stupidity of some customers and the negligence of most of the ISPs these people belong to.

Quote:
EDIT : if you have an issue with an isp then email them - optus is abuse@optushome.com.au and its not hard to do - expecting the ISP to contact you is somewhat pointless as theyre not going to know that you have done it until they have a whole pile of hello off customers - if you have proof then email the ISP the proof BEFORE applying this sort of block ban.


Precisely, the proper procedure in these cases starts with the customer reporting the entire G-line message to their ISP administration. The ISP then should contact the Undernet to work together to deal with the problem. If the Undernet is not contacted, it may mean the ISP doesn't care about the problem, so the ban will remain and their customers won't be able to connect to our network.
As customers, push your ISP for trying to solve the problem, or at least, to contact the Undernet and get to know about the problem.

Quote:
EDIT 2: Oh and i have checked - not one single server will allow an ONC connection to it - same message every time - this of course on an ISP where getting a new IP address is a major exercise ... Bascially we are screwed

Moderator / Undernet Staffers please confirm that with this block ban all Optusnet Customers are NO LONGER WELCOME ON UNDERNET SERVERS ?

If this is the case make a forum post to that effect - may i also suggest that instead of applying these block bans in private that they also be listed in the forums so people can be made aware of the blocks being placed on their ISP.s Id also like to see how many attacks on undernet servers have come from Australian ISP's ? in fact id REALLY like to see that one.


Currently I've seen many users from *.optusnet* connected. I don't think they have been tagged as "not welcome on Undernet" or anything worse than that.

Lastly, G/K-lines list are not public any longer. The feature that allowed simple users to check the list has been disabled in one of the many Ircu upgrades. It has been an administrative decision.

I wish you the best

---
Carlos

PS. References regarding G/K-lines and connection guidelines:

The Undernet acceptable use policy:
http://www.user-com.undernet.org/documents/aup.txt

The Undernet K/G-line FAQ:
http://www.user-com.undernet.org/documents/k-gline.txt

Each individual server's motd (Message of the day):
After connecting to the server, type /motd

Abuse team contact email regarding G-lines or oper abuse:
abuse@undernet.org

PS2. For more information:

The Undernet User Committee:
http://www.user-com.undernet.org
Email: user-com@undernet.org

Online help: /join #userguide


Offline
 Profile  
 
 Post subject:
PostPosted: Wed Mar 05, 2003 9:43 am 

Joined: Tue Mar 04, 2003 1:16 pm
Posts: 14
Location: Australia
Quote:
G-lines are set for a certain amount of time on every individual IP as found abusing the network, whether clones, proxys, flooders, etc. However, if recurrent abuse is found as coming from many hosts within an IP block, i.e. ISP domain, the ban will apply wider and longer.


Over one week now on several IP addresses ? As i said i would like to see the stats for abusers from Optusnet as i have never seen one single abusive user on undernet from an Aust ISP - that being said i still consider banning blocks to be heavy handed when it comes to resolving a situation

Quote:
Certainly it's not our concern how ISPs make money with the service we offer. Undernet, though, has to protect their valuable resources and guests, so we have to ban abusers and try to keep them away from our network as far as possible.


Thus missing my point exactly - the 'get another isp' response was on this board from another Undernet staffer and shows how little people understand. We appreciate this is a free network but the fact is that you have chosen to block a large percentage of a user base from access based on what you decide is either a risk or some people who have abused the service - thus the genuine users are inconvenienced. I of course find this somewhat hilarious on a network that has channels dedicated to sharing porn, mp3's, warez, serials and cracks and movies but blocks people who come from ISP's where there may be a problem ? of course the content being shared isnt your issue i know but it shows a certain interesting attitude.

Quote:
Last time I checked (some minutes ago) I could see many users from *.optusnet.com.au domain being connected to the Undernet. Try again, please.


Have been every 2 hours for a week with several IP's - i cannot connect and neither can most of the friends i have - WHEN might you suggest i will be able to connect ? a time frame might be nice ?

These are people like me running linux machines fully secured with X chat or others and no bots yet we cannot get on getting the same message ? Not on any server. I dont doubt that there are many people connected, of course i and no one i know can get on but that doesnt mean others cannot of course.

Im sure there are users connected and id also be willing to be that not every oputsnet IP is blocked - only the majority of the cable networks thanks to maybe one or 2 abusers - again i wonder how many US and Euro networks are blocked and what the outcry would be if you blocked a significant part of BT or Chello ?

Quote:
We deeply apologise for the inconveniences but in the meantime, we hope users understand we do our best to be as much accurate as possible when banning these lamers. We lack of resources, either human or technical, to contact every single domain we ban due to the stupidity of some customers and the negligence of most of the ISPs these people belong to.


In other words : bad luck blame your ISP. There are 2 major ISP carriers in this country and both of them restrict servers - Optus will disconnect any user found doing what you are claiming they allow yet you justify blocking large portions of the networks based on being busy without making an attempt to contact them ? Claiming ISP's are negligent because some of their customers are scum is judgement and insane - especially when you dont seem to have even tried to contact that ISP

As for accurate as possible we are having this conversation because you are NOT being accurate youre being heavy handed in banning a block - this is banning real users NOT just lamers and i dont understand it or appreciate it and i do not believe it is in any way accurate - as i already stated GETTING A NEW IP ON OPTUS CABLE IS NOT EASY - they are set to modem MAC address and require a hard reset by tech support to change -THUS if you reported the IP there is a VERY VERY strong chance the ISP would take action against the user - but of course the ISP is meant to contact you

With all due respect If this what undernet defines as accurate i think you need a new dictionary

Quote:
Precisely, the proper procedure in these cases starts with the customer reporting the entire G-line message to their ISP administration. The ISP then should contact the Undernet to work together to deal with the problem. If the Undernet is not contacted, it may mean the ISP doesn't care about the problem, so the ban will remain and their customers won't be able to connect to our network.
As customers, push your ISP for trying to solve the problem, or at least, to contact the Undernet and get to know about the problem.


And as has been explained ONC dont know what IP blocks you have banned or why so they cannot take action - if youre dedicated to customer service why not contact them ? is this so hard ? or would you rather ignore those customers.

Quote:
Currently I've seen many users from *.optusnet* connected. I don't think they have been tagged as "not welcome on Undernet" or anything worse than that.


Basically based on your comments above i believe that is EXACTLY the case - if you can connect then good if not bad luck not our problem - this is the same as NOT WELCOME to my mind - and i managed to connect today from a Non Optus account to find all the usual bots, f servers and even abusers connected - seems that theyre fine but we are not.

Quote:
Lastly, G/K-lines list are not public any longer. The feature that allowed simple users to check the list has been disabled in one of the many Ircu upgrades. It has been an administrative decision.


So we do it in secret and its pot luck if you can connect or not ? Why was this and 'administrative decision' ? I have to wonder the motives here


Quote:
I wish you the best


All i WANT is to be able to connect to Undernet again - i dont care about your issues which frankly i have dealt with on other networks for years - perhaps you need more server operators or better policies or just to realise there will always be assholes attacking you , i dont know - frankly i and other customers in this boat just want to get back into our channels or onto the network without this whole hassle.

Frankly i think its all rubbish that this happens in the dark - from what i can see you wont contact Optus and they of course wont contact you as they dont know why they are blocked and dealing with Undernet is dealing with a committee (not to mention the ludicrous comment about 'promising it wont happen again' as if they have control over every single idiot that might occur on their network when Undernet wont even report the abusers to them)

Tell me this - How many of these Netblock bans exist ? or is that confidential as well?

NOT happy.

Quote:
Online help: /join #userguide


This is particularly funny ...


Offline
 Profile  
 
 Post subject:
PostPosted: Wed Mar 05, 2003 10:47 am 
User avatar

Joined: Fri Mar 01, 2002 1:00 am
Posts: 209
Location: Barcelona, Spain
You, your friends and anyone else banned from the Undernet email the entire ban message you gotten to your ISP and say "I've been banned from the Undernet with this message (it should contain the reason of the G-line), and my IP/host is this.... Please, contact abuse@undernet.org to deal with this situation. I can assure I'm a good boy (or I won't be a bad boy any longer)"

eviltwin, I'm trying to be polite and corteus while trying to explain you this situation and how to solve it. At least, TRY OUT what I'm telling you. Contact your ISP, push them, tell them what has happened. Include your IP and your friends' and the messages you gotten when tried to connect, assure them you did nothing wrong, make them contact the abuse team to work together to deal with this. TRY IT OUT !!

---
cArLiLLoS

PS: Who was the Undernet staffer that told you to "change ISPs" ?


Offline
 Profile  
 
 Post subject:
PostPosted: Wed Mar 05, 2003 11:00 am 

Joined: Tue Mar 04, 2003 1:16 pm
Posts: 14
Location: Australia
cArLiLLoS wrote:
You, your friends and anyone else banned from the Undernet email the entire ban message you gotten to your ISP and say "I've been banned from the Undernet with this message (it should contain the reason of the G-line), and my IP/host is this.... Please, contact abuse@undernet.org to deal with this situation. I can assure I'm a good boy (or I won't be a bad boy any longer)"

eviltwin, I'm trying to be polite and corteus while trying to explain you this situation and how to solve it. At least, TRY OUT what I'm telling you. Contact your ISP, push them, tell them what has happened. Include your IP and your friends' and the messages you gotten when tried to connect, assure them you did nothing wrong, make them contact the abuse team to work together to deal with this. TRY IT OUT !!

---
cArLiLLoS

PS: Who was the Undernet staffer that told you to "change ISPs" ?


I have done so and they have told me they CANNOT take any action unless undernet reports the abuse with IP addresses to them - they are not able to follow up without people making these sorts of allegation to them directly not thru a third party and they dont even know what blocks are in place as no one from undernet has contacted them.

This is not a little ISP it is a major multi national telecommunications company with procedures and policies - i can ask them to contact you and i have but they rightly see that they have not been notified of any complaints by anyone at undernet - bascially they have nothing to act on and what i suspect is that one or 2 attackers on one or 2 of the subnets have caused issues and thus those entire subnets have been blocked.

I can appreciate you are trying to be corteuous to me and im trying very hard to do som myself - i have no idea if you personally set these blocks so im not trying to take this out on you but you need to understand that i have had over a week of this frustration and im caught between a network that blames the ISP and an ISP that has no idea what the hell is going on and im the one suffering - these sorts of block bans are going to cause these problems and are a universally bad idea

No one has so far listed what other ISP's are affected by this or even what IP ranges in ONC are blocked and the message i get is they dont intend to - ONC wont take action unless someone in underent complains and Undernet wont take action to lift the bans unless the ISP grovels to them which theyre not going to do esecially without proof of anything and the users are caught in the middle

I know this is not your doing but frankly it stinks and i dont know how else to try and resolve it - i just want to be able to connect again but i cannot see that being achieved.

Im now going to spend another 20-30 minutes on the phone to tech support trying to get another IP to try and connect again - this is how i love spending my nights after working 16 hours.

If undernet TRULY wants to be fair and accurate then remove the block bans and forward the abuse details of Optus customers to abuse@optusnet.com.au with full details and logs - they WILL take action as i have done so in the past on austnet servers and other breaches of security

I appreciate youre trying to help me and i thank you - i just dont see how any of this is the fault of us users who do the right thing and would cheerfully hang abusers from a tall post if we could catch them .. Yet we are the ones who are suffering.

Oh and the undernet staffer was a server operator and im not going to say which server as i have no intention of breaking a confidence .


Offline
 Profile  
 
 Post subject: And on this subject
PostPosted: Wed Mar 05, 2003 11:24 am 

Joined: Tue Mar 04, 2003 1:16 pm
Posts: 14
Location: Australia
For those people who dont understand how Optus works it is impossible to change and IP without physcially changing network adapters or leaving a system off the network for 18 hours to get a new lease - and of course id likely just get another blocked IP range as well -This whole problem happened because i was away for a few days and had unplugged all of my gear due to storm risks here and thus had lost the IP i had had for a long time - if i had not done that i would of course be fine.

Optus confirm to me that they have had no contact from Undernet and are unable to do anything about fixing this unless that is done - They have told me that undernet needs to provide details of the IP addresses of people abusing this system and they will act.

My ip range is 211.28.236.* and i would at least appreciate it if SOMEONE can confirm that this range is blocked - i would of course prefer if the block was removed to fix it but thats obviously wishfull thinking

Forgive me but right now im caught in the middle and i dont see any chance of a resolution at all.

EDIT : i will of course be leaving my systems off all night and day toomorrow in an attempt to hopefully get an IP in a non blocked range - this causes me issues but i see no other way to get this resolved - of course i dont expect replies seeing as how the time difference works against us in australia - which extends this another day. I would love and AU undernet server - id even consider setting one up but see no point to it under this present system - im not ever going to be comfortable with block bans and would not be setting up an AU server whilst it seems parts of one of the largest AU isp's are blocked from the service.


Offline
 Profile  
 
 Post subject: Re: And on this subject
PostPosted: Wed Mar 05, 2003 12:52 pm 

Joined: Wed Mar 05, 2003 12:47 pm
Posts: 1
Mines 210.49.49.xxx which explains why some users are connecting.

Optus IPs can last for months unless you swap from USB-Ethernet or change the mac address of your etehrnet card.


Offline
 Profile  
 
 Post subject:
PostPosted: Thu Mar 06, 2003 7:53 am 

Joined: Tue Mar 04, 2003 1:16 pm
Posts: 14
Location: Australia
I have an email from abuse@undernet :

Quote:
The gline is on ~*@211.* if you resolve to an alpha host, or have identd
from a real Internet provider, you should be able to connect. Try turning on the identd server in your mIRC, if you use mIRC. or talk to
your Internet provider about installing identd.

The problem was not just a few users or abusers but 100's, sometimes
thousands, of insecure 211.*'s being used to for bnc's, botnets and hackers.


Basically what that says is that the entire 211.* class is blocked so bad luck to any ISP who has users in it - ONC own 2 ranges in that and im guessing that the reason undernet wont contact optus is that they do not have ANY abusers from optus - its just bad luck

I wont even go into the arrogance of the 'real' isp comment which is more than a little insulting - im guessing that only the USA and Europe have 'real' ISP's we suckers just have crappy ones it seems.

Oh and leaving my modem off did nothing - i have no new IP and im still 100% blocked - as i said Optusnet customers in the 211 range are no longer welcome on undernet - way to go guys

I bet this is about as effective as blocking whole ISP's has been in the past.

Thanks really.

EDIT: oh and Identd doesnt work either - same issue. Id ask if theres a work around but really im not welcome on the service it seems and i doubt anyone would tell me



_________________
--------
Banning blocks punishes the innocent customers of the service without actually doing anything usefull to stop abusers.
Offline
 Profile  
 
 Post subject:
PostPosted: Thu Mar 06, 2003 9:07 am 
User avatar

Joined: Fri Mar 01, 2002 1:00 am
Posts: 209
Location: Barcelona, Spain
Quote:
The gline is on ~*@211.*


Enable identd on your PC or IRC client and you should be able to connect. If you somehow could forward data traffic to port 113 (identd) (maybe your ISP technical assistance could help you in this), you would be able to enable the ident daemon and remove that "~" char in front of your userid.

I can't do anything else, I'm sorry and Good luck

---
Carlos

PS. We have discussed this topic quite a lot, I think. I hope you really find this useful.


Offline
 Profile  
 
Display posts from previous:  Sort by  
 Page 1 of 1 [ 11 posts ] 

All times are UTC [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to: