Site User With Strange Problem After the Migration to Knownhost

Gimpy

Gimpy

Member
Greetings,

Just after the my recent migration to knownhost, one of my regular website (phpBB3 forum) users reported a problem that we can't explain and I was hoping someone here might be able to shed some light on the issue.

The user's normal web surfing habit is to log in and quickly open several tabs of the new threads on my forum. This may be 10+ new tabs containing fairly large images (up to 5mb per image). This worked fine for the user on my previous host.

The problem they are now reporting is that often, the site simply quits responding when they do this. The user cannot even ping the site. However, they can surf to any other website just fine. They are reporting that after ~30 minutes, the connection clears they can continue to surf my site on knownhost. We are really at a lost as to explain why this is happening. No other users on my site have this problem and no one else can duplicate the issue.

Is there any way knownhost or the data center could be temporarily blocking this user's IP?

Any ideas what could be happening here?

Thanks!
 
Hi Gimpy,

I bet the users are hitting the max connection limit set in the CSF firewall. You can increase this in the config and it will prevent them from being temp banned.

Should be the CT_LIMIT setting in the /etc/csf/csf.conf file, or you can edit it via the gui editor in WHM.
 
Hi Gimpy,

This sounds like a CSF block to me too. However you should be getting an email notification about temporary and permanent blocks as soon as they happen.
 
Certainly sounds like a CSF block, the question is, does Gimpy get email notifications for other firewall activity? Perhaps the email address is not configured or not being delivered.
 
OK. I checked the CT_LIMIT and it was set to 50, which seemed a bit low. My research turned up that the most frequently used value here is 300 so I set it to that.

I also noticed that the CT_ALERT was turned off (=0), even though the default was supposed to be turned on (=1), so that would explain why I didn't get an email alert. However, I'm not getting any other alerts from the firewall, either. The only emails I have ever gotten are root login notifications and the large daily update report.

Should I be getting other email notifications?

Thanks!
 
Hi Gimpy,

In WHM go to Server Contacts then Edit System Mail Preferences and make sure that your email address is in there. I put mine in for all 3 options there.

By default CSF should email all alerts to root.
 
You must log in or register to reply here.
Top