zorba111
asked on
Trying to access IIS on our local SBS Server - getting message saying our IP address is not allowed..
I was accessing RWW (Remote Web Workspace) in the office from my home when I started getting access denied 2 days ago, with this message:
Strangely, I also couldn't access yahoo from my home computer either. Has my home router been compromised somehow? And is doing something that has put my home IP address on a blacklist?
I'm the only person in my company/office and I certainly didn't make any changes recently on IIS, not least limiting any IP addresses.
Then strangely from *the office itself* I tried to access RWW as well, as an experiment, and I got the same message as above!!
This would indicate that there *is* a problem with my webserver too. Overloaded?
What are the chances that both home and work setup should go wrong at the same time???
You are not authorized to view this page
The Web server you are attempting to reach has a list of IP addresses that are not allowed to access the Web site, and the IP address of your browsing computer is on this list.
Please try the following:
•Contact the Web site administrator if you believe you should be able to view this directory or page.
HTTP Error 403.6 - Forbidden: IP address of the client has been rejected.
Internet Information Services (IIS)
Technical Information (for support personnel)
•Go to Microsoft Product Support Services and perform a title search for the words HTTP and 403.
•Open IIS Help, which is accessible in IIS Manager (inetmgr), and search for topics titled About Security, Limiting Access by IP Address, IP Address Access Restrictions, and About Custom Error Messages.
Strangely, I also couldn't access yahoo from my home computer either. Has my home router been compromised somehow? And is doing something that has put my home IP address on a blacklist?
I'm the only person in my company/office and I certainly didn't make any changes recently on IIS, not least limiting any IP addresses.
Then strangely from *the office itself* I tried to access RWW as well, as an experiment, and I got the same message as above!!
This would indicate that there *is* a problem with my webserver too. Overloaded?
What are the chances that both home and work setup should go wrong at the same time???
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I'm going to try your suggestions tonight at home. Printing off your answer now in case I still can't access EE and/or yahoo
ASKER
I wasn't at home much since last weekend to check this but I was there last night.
From home:
I can still login to our server for RWW.
Can't access yahoo.
Can access experts-exchange HTTP, but when I try and login, can't access the HTTPS service.
I went through the steps you gave me Dan.
Rebooting the router *does* reset the last 2x parts of the IP address (c and d of a.b.c.d) so it is DHCP.
Changing the IP address does not change the access to the websites. (When RWW was blocked for the original reason above, rebooting didn't make the difference - the difference in getting access to RWW seems to have been rebooting the RWW server).
Next I checked the home IP addresses against blacklists.
The first one was blacklisted on 4 lists: b.barracudacentral.org, l2.apews.org, pbl.spamhaus.org, zen.spamhaus.org.
The second IP address was blacklisted on the same 4 lists.
(The http://whatismyipaddress.com/ is a nice tool and I will use it in the future. For example I was able to confirm that our RWW server IP is *not* on any blacklist).
Hmmm, my home PC is old - its running XP I think (and if it is, support and therefore patches ended last year - why is it still "updating" every night? hmmmm). Could be that this PC is compromised, combined with a broadband provider (TalkTalk) that is using IP ranges that include previously blacklisted IPs.
Well, the main thing is I can access RWW from home again.
I think there were a combination of factors here. Dan thanks for your contribution, armed me with tools and lines of enquiry for further investigation as and when issues arise.
From home:
I can still login to our server for RWW.
Can't access yahoo.
Can access experts-exchange HTTP, but when I try and login, can't access the HTTPS service.
I went through the steps you gave me Dan.
Rebooting the router *does* reset the last 2x parts of the IP address (c and d of a.b.c.d) so it is DHCP.
Changing the IP address does not change the access to the websites. (When RWW was blocked for the original reason above, rebooting didn't make the difference - the difference in getting access to RWW seems to have been rebooting the RWW server).
Next I checked the home IP addresses against blacklists.
The first one was blacklisted on 4 lists: b.barracudacentral.org, l2.apews.org, pbl.spamhaus.org, zen.spamhaus.org.
The second IP address was blacklisted on the same 4 lists.
(The http://whatismyipaddress.com/ is a nice tool and I will use it in the future. For example I was able to confirm that our RWW server IP is *not* on any blacklist).
Hmmm, my home PC is old - its running XP I think (and if it is, support and therefore patches ended last year - why is it still "updating" every night? hmmmm). Could be that this PC is compromised, combined with a broadband provider (TalkTalk) that is using IP ranges that include previously blacklisted IPs.
Well, the main thing is I can access RWW from home again.
I think there were a combination of factors here. Dan thanks for your contribution, armed me with tools and lines of enquiry for further investigation as and when issues arise.
ASKER
response didn't "fix" the problem (aspects of which have been resolved independently), but it does offer new tools and methodology for understanding more about this problem domain
ASKER
I couldn't try your suggestions from home because I couldn't even get onto Experts Exchange from home!
(which together with the yahoo denial, *does* suggest my home IP was on a blacklist).
This was even after a router reboot.
As for the access *from* the office, *via* RWW, *to* out office IIS.... well I have a hazy memory now that in the past this particular path didn't work, and I remember having to bring my laptop into work, connect using mobile internet (i.e. *not* the local office network) to test out RWW. So there must be something in RWW that prevents local access from the same LAN.... If my memory serves me.
The good news is that I could access RWW from home this morning. I didn't have time to test the other domains (google, experts exchange etc.). In between I rebooted the server that IIS runs on. I'm tending to think that maybe overloading the server had somehting to do with the IP denials. I remember in the past, when the server was busy, we had problems logging into RWW (but never with this "IP denied" error message).