TCP Port 80??

[Doc]

Seems my IP may be blocked to NESR

I get some message that says a firewall isn\'t allowing me or some such and that the fiewall admin should enable TCP 80...

Any ideas?

[Kurlon]

So... how'd you post this?

And I doubt it's NESR generating that message, look closer to home.

[Doc]

Proxy server.

I get a message that Internet Explorer cannot display the web page...

I click diagnose and I get a windows diagnostics message that says NESR is online but not responding to my connection. Also says my firewall is working properly to allow the connection but a remote firewall might be blocking the connection.

It then says if I have acces that i should configure the firewall to allow connections thru TCP port 80...

I have ,messed with my firewalls (of and on), tried an IP release and renew and nothing...

I get ever other site BUT NESR (without the proxy server). I get it at work and on my phone without problems as well.

I think something is blocking me but I can\\\\\\\\\\\\\\\'t figure out what.

[Danz19899]

Proxy server.

I get a message that Internet Explorer cannot display the web page...

I click diagnose and I get a windows diagnostics message that says NESR is online but not responding to my connection. Also says my firewall is working properly to allow the connection but a remote firewall might be blocking the connection.

It then says if I have acces that i should configure the firewall to allow connections thru TCP port 80...

I have ,messed with my firewalls (of and on), tried an IP release and renew and nothing...

I get ever other site BUT NESR (without the proxy server). I get it at work and on my phone without problems as well.

I think something is blocking me but I can\\\\\\\\\\\\\\\'t figure out what.

found your problem . . . download firefox see it it works on a different browser

[jcbell1007]

either that, or go into your router and turn off all firewalls so there's no blocked traffic.

[NobodySpecific]

I'm assuming this is at home? How long has it been like this? Did you change any hardware around the time that this started happening (router or cable modem)? What are you running for a software firewall (if any)?

I would definitely try another browser before doing anything else.

[Doc]

Yep is at home. No new Hardware, Firewall is Norton. I may have had some software updates recently.

[NobodySpecific]

Norton sucks. Is it a laptop or desktop? If you bring it to bike night and it is a problem on the computer itself I'm certain somebody would have it fixed before you left. Do you go through a router or just the cable modem? It's possible that you accidentally changed the settings on the router, though highly unlikely. I could swing by and take a look, but I'm not sure I could fix it.

[Doc]

Yes I go through a router. I don\'t know how I would have changed the settings...

Come on by. I am home all day.

[NobodySpecific]

Well I'm at work, but I should get out around 5 so I can swing by after that. Have you tried using Firefox?

[Doc]

I have tried Firefox in the past. Not recently though.

[gadget]

Port 80 is HTTP access.
If you can reach any regular site with http:\\ then port 80 is open and you do not need to mess with it. This suggests that your PC is blocking access to this specific site.

Try deleting temporary internet files and history.
This is located under Tools>Internet Options. On the first Tab select Delete under "Browsing History"
Using another Web Browser like Firefox would bypass this step.

Also, take a look at Norton Firewall and check to make sure the this particular website is not being blocked. The reason I suggest looking at Norton Firewall is that it is likely that your error is being reported by Windows and it is not identifying the Norton Firewall as being local.

[NobodySpecific]

Port 80 is HTTP access.
If you can reach any regular site with http:\\ then port 80 is open and you do not need to mess with it. This suggests that your PC is blocking access to this specific site.

Try deleting temporary internet files and history.
This is located under Tools>Internet Options. On the first Tab select Delete under "Browsing History"
Using another Web Browser like Firefox would bypass this step.

Also, take a look at Norton Firewall and check to make sure the this particular website is not being blocked. The reason I suggest looking at Norton Firewall is that it is likely that your error is being reported by Windows and it is not identifying the Norton Firewall as being local.

This is why I keep asking Doc to try Firefox, because I thought if it was IE settings that got messed up this would bypass that. Yet all he says is that he's used it in the past. It will take 30 seconds to try...

[Jim]

Wirelessly posted (BlackBerry Giggity: BlackBerry8330/5.0.0.438 Profile/MIDP-2.1 Configuration/CLDC-1.1 VendorID/104)

Port 80 is web traffic. You're trying to say you can't get on the internet at all without bypassing everything by goung through a proxy? And I assume the proxy is using port 443 if you can't use 80.


Doc sucks

[Frankenstein]

Doc, PM me the external IP that's having this issue. I've got some fairly strict security checks running on this server so based on what you've told us, it's possible/likely that you got squashed by the firewall or mod_security.

[Frankenstein]

Nevermind, I found it. mod_security detected PHPB Worm SQL injection attempts from your system so you got blocked by the firewall.

Here's the log entry (cleaned up for the sake of privacy):
Time: Wed Oct 6 10:12:23 2010 -0400
IP: x.x.x.x (US/United States/c-x-x-x-x.hsd1.vt.comcast.net)
Failures: 5 (mod_security)
Interval: 300 seconds
Blocked: Yes

Log entries:

[Wed Oct 06 10:11:35 2010] [error] [client x.x.x.x] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:\\x27|%27|\\x2527|%2527)" at ARGS:highlight. [file "/usr/local/apache/conf/modsec/99_asl_jitp.conf"] [line "5657"] [id "310080"] [rev "1"] [msg "Atomicorp.com - FREE UNSUPPORTED DELAYED FEED - WAF Rules - Just In Time Patch: PHPBB worm"] [severity "CRITICAL"] [hostname "www.nestreetriders.com"] [uri "/forum/bike-night-vermont/58882-docs-garage-tear-down-rebuild-thread-8.html"] [unique_id "TKyDl60tddIAAA5zL24AAAAH"]

[Wed Oct 06 10:11:40 2010] [error] [client x.x.x.x] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:\\x27|%27|\\x2527|%2527)" at ARGS:highlight. [file "/usr/local/apache/conf/modsec/99_asl_jitp.conf"] [line "5657"] [id "310080"] [rev "1"] [msg "Atomicorp.com - FREE UNSUPPORTED DELAYED FEED - WAF Rules - Just In Time Patch: PHPBB worm"] [severity "CRITICAL"] [hostname "www.nestreetriders.com"] [uri "/forum/bike-night-vermont/58882-docs-garage-tear-down-rebuild-thread-8.html"] [unique_id "TKyDnK0tddIAABFGKjMAAAAJ"]

[Wed Oct 06 10:11:45 2010] [error] [client x.x.x.x] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:\\x27|%27|\\x2527|%2527)" at ARGS:highlight. [file "/usr/local/apache/conf/modsec/99_asl_jitp.conf"] [line "5657"] [id "310080"] [rev "1"] [msg "Atomicorp.com - FREE UNSUPPORTED DELAYED FEED - WAF Rules - Just In Time Patch: PHPBB worm"] [severity "CRITICAL"] [hostname "www.nestreetriders.com"] [uri "/forum/bike-night-vermont/58882-docs-garage-tear-down-rebuild-thread.html"] [unique_id "TKyDoa0tddIAABFFJdMAAAAG"]

[Wed Oct 06 10:11:51 2010] [error] [client x.x.x.x] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:\\x27|%27|\\x2527|%2527)" at ARGS:highlight. [file "/usr/local/apache/conf/modsec/99_asl_jitp.conf"] [line "5657"] [id "310080"] [rev "1"] [msg "Atomicorp.com - FREE UNSUPPORTED DELAYED FEED - WAF Rules - Just In Time Patch: PHPBB worm"] [severity "CRITICAL"] [hostname "www.nestreetriders.com"] [uri "/forum/pit-area/55882-kurlonizing-classic.html"] [unique_id "TKyDp60tddIAABElHa8AAAAK"]

[Wed Oct 06 10:12:19 2010] [error] [client x.x.x.x] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:\\x27|%27|\\x2527|%2527)" at ARGS:highlight. [file "/usr/local/apache/conf/modsec/99_asl_jitp.conf"] [line "5657"] [id "310080"] [rev "1"] [msg "Atomicorp.com - FREE UNSUPPORTED DELAYED FEED - WAF Rules - Just In Time Patch: PHPBB worm"] [severity "CRITICAL"] [hostname "www.nestreetriders.com"] [uri "/forum/bike-night-vermont/58882-docs-garage-tear-down-rebuild-thread.html"] [unique_id "TKyDw60tddIAABFJKvcAAAAO"]

[drop]

doc has worms.

[Jim]

Wirelessly posted (BlackBerry Giggity: Mozilla/5.0 (iPod; U; CPU iPhone OS 3_1_2 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7D11 Safari/528.16)

Looks like Doc's IP sucks too

[The Snowman]

Nevermind, I found it. mod_security detected PHPB Worm SQL injection attempts from your system so you got blocked by the firewall.

Looks like Doc's just a virus.

[Kurlon]

So... how'd you post this?

And I doubt it's NESR generating that message, look closer to home.

Nevermind, I found it. mod_security detected PHPB Worm SQL injection attempts from your system so you got blocked by the firewall.

Here's the log entry (cleaned up for the sake of privacy):
Time: Wed Oct 6 10:12:23 2010 -0400
IP: x.x.x.x (US/United States/c-x-x-x-x.hsd1.vt.comcast.net)
Failures: 5 (mod_security)
Interval: 300 seconds
Blocked: Yes

Damn, guessed wrong, it WAS NESR generating the error. D-oh!

[NobodySpecific]

Needless to say I will not be swinging by after work today

[Doc]

So I have worms or a virus?

[Frankenstein]

So I have worms or a virus?

That's what the scan logs suggest, yeah. The detection rules I use (ASL from gotroot.com) have been solid so far, no false positives that I've seen.

[Doc]

Ok, I ran Norton Anti virus and downloaded AVG as well...

Didn't seem to fix the issue. Any other suggestions?

[Jim]

Wirelessly posted (BlackBerry Giggity: Mozilla/5.0 (iPod; U; CPU iPhone OS 3_1_2 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7D11 Safari/528.16)

Don't treat your PC like a Hawk