Extension version checks from my AWS EC2 instance being blocked

[sentience]

I have the Forum Subs extension installed on my board, which is hosted on an AWS EC2 server.

Recently, all of of the screens that Forum Subs adds to my ACP have started timing out when I try to view them. I have traced the timeout to the extension's version check request to http://version.phpbbdev.space/versions/ ... _file.json. I can load this URL just fine on my local machine, but on the EC2 instance where my board is hosted, attempting to Curl this URL also fails in a timeout.

A traceroute from my EC2 instance shows that network traffic from my EC2 instance is being dropped:

[ec2-user@ip-172-31-29-106 core]$ traceroute -n 149.255.57.44
traceroute to 149.255.57.44 (149.255.57.44), 30 hops max, 60 byte packets
1 242.4.76.3 92.533 ms 242.4.77.7 92.505 ms 242.4.76.131 92.692 ms
2 151.148.10.20 93.054 ms 93.526 ms 94.027 ms
3 151.148.10.21 98.558 ms 98.542 ms 98.579 ms
4 8.245.0.134 92.694 ms 92.673 ms 92.719 ms
5 103.31.184.6 92.376 ms 92.492 ms 92.339 ms
6 5.254.78.94 267.310 ms 265.991 ms 266.315 ms
7 5.254.112.185 1061.745 ms 1053.403 ms 1061.633 ms
8 5.254.112.162 266.119 ms 265.157 ms 265.146 ms
9 149.11.70.194 256.332 ms 256.573 ms 256.574 ms
10 185.7.88.86 262.613 ms 263.382 ms 263.356 ms
11 149.255.60.21 257.226 ms 257.194 ms 256.582 ms
12 149.255.56.20 256.050 ms 256.041 ms 256.364 ms
13 * * *
14 * * *

Is it possible to unblock this? If not, I will need to modify the extension's code to skip the version check in order to get it working on my server again.

Thanks in advance!

[devspace]

Is curl enabled on the server?

ACP > System > PHP information and in there should be a section on curl.

[sentience]

Thanks for your reply!

Yes, Curl is enabled on my server: screenshot

From a terminal on my server, I'm able to use curl to fetch URLs from other hosts successfully, but version.phpbbdev.space just times out.

[devspace]

If this has been working until recently then what has changed on your server as nothing has changed at this end?

Is it possible that your hosts have increased security to try and prevent bots and in doing so have blocked this server?

[sentience]

Yep, it’s been working until recently, and I’ve made no changes.

I’ll contact AWS Support to see if they can explain it.

[sentience]

In case it rings a bell, the last hop I can see in my traceroute belongs to “Unlimited Web Hosting”. It would seem they are the party that is blocking the traffic.

Code: Select all

% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See https://docs.db.ripe.net/terms-conditions.html

% Note: this output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '149.255.56.0 - 149.255.56.255'

% Abuse contact for '149.255.56.0 - 149.255.56.255' is 'email@unlimitedwebhosting.co.uk'

inetnum:        149.255.56.0 - 149.255.56.255
netname:        UNLIM-1
descr:          Unlimited Web Hosting UK LTD (Cloud Hosting Services)
country:        GB
admin-c:        ASLN-RIPE
tech-c:         ASLN-RIPE
status:         ASSIGNED PA
mnt-by:         UM82926-MNT
mnt-lower:      UM82926-MNT
mnt-routes:     ASL-MNT
mnt-domains:    ASL-MNT
created:        2015-02-14T08:15:07Z
last-modified:  2019-09-04T09:08:44Z
source:         RIPE

role:           Awareness Software NOC
address:        Unit 5, Rhino Court
address:        Station View
address:        Hazel Grove
address:        Stockport
address:        Greater Manchester
address:        SK7 5ER
address:        United Kingdom
mnt-by:         ASL-MNT
abuse-mailbox:  email@aware-soft.com
org:            ORG-ASL4-RIPE
admin-c:        PAO-RIPE
tech-c:         PAO-RIPE
tech-c:         JW2190-RIPE
tech-c:         NIG-RIPE
nic-hdl:        ASLN-RIPE
created:        2007-06-21T10:12:34Z
last-modified:  2021-03-04T14:56:24Z
source:         RIPE # Filtered

% Information related to '149.255.56.0/21AS34931'

route:          149.255.56.0/21
descr:          Unlimited Web Hosting UK LTD
origin:         AS34931
mnt-by:         ASL-MNT
created:        2012-12-09T09:49:52Z
last-modified:  2012-12-09T09:49:52Z
source:         RIPE

% This query was served by the RIPE Database Query Service version 1.120 (SHETLAND)

This does seem to be in the same IP range as your web server. So the blocking does seem to be happening in your host’s systems.

[devspace]

I've not had any notification from my hosts about blocking anything, but it is possible that they are. I have not had anyone else having problems which I would have thought would be happening.

If your server is being blocked then I would guess that it is AWS which is being used extensively for aggressive bots.

What is the IP of your server and which country are you in?

[sentience]

My server's IP is 3.27.129.85. It's in Amazon's ap-southeast-2 (Sydney, Australia) region.

[devspace]

Can you try again - I was blocking that range of IP addresses due to spamming

[sentience]

Thanks! That fixed it.