OVH Community, your new community space.

OVH blocking Undernet


darkfyre
27-08-2010, 08:13
Looks like the community has also noticed this :

http://www.webhostingtalk.com/showthread.php?t=975896

I like this post:

Let people be people and be responsible for their own actions. We're not police, we're not government. We're service providers.

Rilly
26-08-2010, 14:00
I'd rather not have to do workarounds.. I don't always know what servers my customers are connecting to; honestly.. what irc shell service asks for a list of irc servers that your eggdrops are going to connect to? Never

Thelen
26-08-2010, 09:39
Cos neither me nor my users use it, and I ain't going to put effort into rectifying OVH's mistakes

zydron
26-08-2010, 08:25
Well why don't you setup a proxy then?

you have servers at LW...

Thelen
26-08-2010, 02:51
LOL Rilly yea good points

Someone just need to setup a proxy for it, route all traffic to those IP via a 3rd party

Rilly
25-08-2010, 18:44
any irc server that in OVH's opinion has a hacking channel on it will be off limits.. so far undernet, and abjects.. no idea how many others since nobody will provide me a list, but there is no workaround.. even whitelisting the servers via control panel will not work.

So.. because some servers got hacked, and those hacked servers connected to undernet or abjects.net, all other 80,000 servers must be blocked..

Its not going to stop the hacking of course... the server will be hacked regardless.. Does OVH think that hackers will not target their servers now because some irc servers are blocked???

Yemble
25-08-2010, 09:32
Quote Originally Posted by marks
from Undernet, yes, it's blacklisted. That's because of we had lots of hacks from those servers. This means users from those servers logging into OVH servers through IRC to perform illicit actions in this.

As Angie says, if your server has been marked as hack, rise the issue in a ticket for them to check if it's a clean installation or not.
Well I did a complete reimage after the threatening message from ovh about being hacked. That was a huge hassle and cost me time and money while I tried to arrange data backups at <24 hrs notice. Not impressed.

Is there a workaround for connecting to undernet (explicitly whitelisting some servers via the control panel?) or is this a deadend??

Rilly
24-08-2010, 02:36
So.. what I've been told is that essentially all IRC networks much be defined in your OVH Manager for every server and irc server, else they will assume it is hacked.

Because i run an irc shell business... i have to enter as many IRC servers on all my OVH servers, and PER Ip address within the OVH Manager.. because.. irc shell account providers don't track what OVH server people connect to... Why would we? as long as they are not doing anything illegal or nasty.. I think if OVH doesn't want users on IRC, they should have said so.. this is an account management nightmare for me now.

Euan
24-08-2010, 00:19
I will admit, I am the first to say that OVH is a budget provider, but blocking an entire network because of SOME attacks is pretty dumb. Is freeserve or w/e the other free IRC network still blocked? I seem to remember a thread about that previously.

adama
23-08-2010, 19:26
And darkfyre, don't expect to get notification form them about this, they don't even seem to have told their own staff, as all of the support replies i've gotten from them have completely misunderstood the issue.

adama
23-08-2010, 19:24
Wait, what is the reason for blocking Undernet?

"because maybe some hackers come from it, I don't know, what's IRC? is it like an internet?"

Bad decision, even worse excuse. You *CAN NOT* stop botnets this way, they'll just connect to another C&C system.

You can however, royally **** off your paying customers who pay for your services just so they can have reliable connections to these networks.

It's not *our* fault some people use IRC as a command and control path, stop penalising us for things other people do.

darkfyre
23-08-2010, 18:39
Thanks for the clarification Marks.

Is there any announcement list for customers to inform us of when you are blocking access to a range of IP's ?

Just seems weird that OVH would block access to another network without giving any notice to anyone.... unless I am mistaken and missed the announcement.

Rilly
23-08-2010, 17:16
What about abjects.net as well?

Can I get a list of IRC servers that are blocked or plan on being blocked?

marks
23-08-2010, 16:24
Quote Originally Posted by darkfyre
Perhaps Marks or someone could let us know officially ... are OVH blocking outgoing IRC connections?
from Undernet, yes, it's blacklisted. That's because of we had lots of hacks from those servers. This means users from those servers logging into OVH servers through IRC to perform illicit actions in this.

As Angie says, if your server has been marked as hack, rise the issue in a ticket for them to check if it's a clean installation or not.

fozl
23-08-2010, 14:57
6667 is blocked by default. It can be unblocked via the Manager.

Ah, but you know that.

darkfyre
23-08-2010, 07:52
bumping so the OVH Uk staff see this thread and provide us with an official reply to the question:

"Have OVH blocked any outgoing protocols or ports without providing any prior notice - specifically relating to IRC and not meaning the IRC option in the manager"

stugster
21-08-2010, 14:44
Blocked with three of our OVH servers too.

adama
21-08-2010, 14:04
I believe it's usually called censorship.

Did the chinese government buy OVH?

darkfyre
20-08-2010, 19:54
OVH do not say anywhere in their terms that they block access to IRC servers - they do say that you need approval to run a service (bot / server etc - but not an IRC client).

If OVH have blocked IRC access, you could no doubt claim under their SLA, as it seems that due to their error they are not providing the service you have paid in advance for (access to the internet essentially).

Perhaps Marks or someone could let us know officially ... are OVH blocking outgoing IRC connections?

I personally dont run any, but if OVH are going to block a protocol or set of ports without giving prior notice, then im very concerned and worried.

(apart from the obvious unblocking of the ports from the manager which we all know about)

yonatan
19-08-2010, 03:12
I can confirm this

telnet Helsinki.FI.EU.Undernet.org 6667
Trying 195.197.175.21...
telnet: connect to address 195.197.175.21: Connection timed out

also does not work to my fav(local ISP) efnet server.
telnet irc.inter.net.il 6667
Trying 192.116.231.44...
telnet: connect to address 192.116.231.44: Connection timed out


Is this a measure against "perl bot " botnets ? or against eggdrop/bnc businesses ?

Ill have to notify all my VPS clients that IRC is not working anymore ( none of them are using IRC actually , but just in case ).

alright those public annoying network blocked i can accept, but why block the largest open source community ?
~]# telnet holmes.freenode.net 7000
Trying 213.232.93.3...
telnet: connect to address 213.232.93.3: Connection timed out

that is just wrong... say now i cant run a pastebin bot anymore? ( for example of a good bot )

guys open this up.. its not fair for all the legit IRC users.

adama
19-08-2010, 02:35
Maybe they are assuming "Undernet" is a hacker network, because of its name.

adama
19-08-2010, 02:22
note also that it's not just helsinki, but *every* Undernet server.

It's not a null route either, it's just tcp 6660-6669/7000

adama
19-08-2010, 02:21
I hear hackers also use google, maybe they should block google.

Also hackers also sometimes use the internet, i say we block the internet.

Also, hackers breath. And drink water.

Such stupidity.

Rilly
19-08-2010, 02:04
I've been getting numerous emails from OVh as well stating I need to reimage my servers because they are detecting undernet connections - apparently connecting to Undernet means your a hacker... Its not an error.. it is on purpose. If they don't re-evaluate their IRC notions, I'm probably going to have only a couple of days to move customers off of 6 servers. What I don't understand is, if they are blocking undernet..... why do I need to reimage my business servers? If I can't connect to undernet anymore, i'm fine with that, i'll add that to my FAQ/TOS.. but it doesn't mean the server is hacked


This is what I received from their support team...

Hi,

this check over IRC problems has not be run with an robot but has been run by our technical director.
We have find out a lot of IP's connect to an irc undernet hacker channel.

In the point 7 of your contract you can read by the way that OVH can suspend at all moment all services like: camfrog, IRC, ircd, eggdrop and other service.

Our first priority is to keep our network clean and to protect our network agains hackers.

If you need I can check your server to see if there are any problem or not and add you to the list of 'clean servers'.
http://help.ovh.co.uk/InstallOvhKey

Do not forget that if you run irc or if you do buissness with irc you must survey what the ircbots or ircd servers are doing.
Is your responsability to ensure that they do nothing nasty.
Best regards,
Angie

Thelen
19-08-2010, 01:31
Bawksd here too.

More than likely they might not be censoring but instead have no/null route to them

victor:/home# telnet Helsinki.FI.EU.Undernet.org 6667
Trying 195.197.175.21...
telnet: Unable to connect to remote host: Connection timed out
victor:/home#

ExW
19-08-2010, 00:09
confirming

Iray
19-08-2010, 00:09
confirmed here too. hope this is just an error rather than ovh trying to censor its stuff inside its network

zydron
18-08-2010, 23:05
Same here

jonlewi5
18-08-2010, 21:38
Quote Originally Posted by Myatu
I can confirm on my OVH server that I am unable to reach Helsinki.FI.EU.Undernet.org, but from a non-OVH server it's fine.
confirmed here also

Myatu
18-08-2010, 21:19
I can confirm on my OVH server that I am unable to reach Helsinki.FI.EU.Undernet.org, but from a non-OVH server it's fine.

adama
18-08-2010, 16:44
I'll let you work out why that is completely irrelevant all by yourself.

LawsHosting
18-08-2010, 16:27
do a traceroute to that ip, see where its failing/blocked.

adama
18-08-2010, 16:12
Maybe it would help if i pasted the correct port when the OVH connection fails


root@alpha:~# telnet Helsinki.FI.EU.Undernet.org 6667
Trying 195.197.175.21...
telnet: Unable to connect to remote host: Connection timed out
root@alpha:~#

adama
18-08-2010, 16:12
From my OVH server :


root@alpha:~# telnet Helsinki.FI.EU.Undernet.org 7000
Trying 195.197.175.21...
telnet: Unable to connect to remote host: Connection timed out
root@alpha:~#

From a non-OVH server :


root@kermit:~# telnet Helsinki.FI.EU.Undernet.org 6667
Trying 195.197.175.21...
Connected to Helsinki.FI.EU.Undernet.org.
Escape character is '^]'.
NOTICE AUTH :*** Looking up your hostname
NOTICE AUTH :*** Checking Ident
^C^]
telnet> quit
Connection closed.
root@kermit:~#

And yes it is in my allow-list on the control panel:

94.23.244.192 195.197.175.21 :6667 ALLOW

The same happens with every other Undernet server, and a few IRCnet servers.

adama
18-08-2010, 16:09
haha and they filter i d i o t as a rude word. what stupidity.

adama
18-08-2010, 16:09
Has anyone else noticed OVH blocking Undernet recently?

My Undernet connection (and today my IRCnet) dropped, and OVH have started sending me *****ic emails claiming my server is part of a botnet, because of repeated attempts to connect to IRC. They're now claiming that their automated rubbish will disconnect my server if I don't reinstall it.

Seems to me like they created the "issue" that they're now reacting to.

Sadly, because no one who reads their tickets can read english, I've only been able to get unreadable replies from them.

Seems I finally get to encounter the legendarily bad support from OVH.