Facebook
Twitter- Server operating system version
- Almalinux 8
- Plesk version and microupdate number
- Plesk 18.0.63 #4
I have a firewall in front of the Plesk web server. (Endian Community) My web server is not very active, it has only 10-15 sites whose traffic shouldn't be more than 40-50GB monthly but I see 500-700GB traffic due to "bad bots". So from time to time, I go to Fail2Ban interface to look for IP patterns to block them on firewall level. For example I block cloud services (like Amazon, Google, Microsoft) (not the search engines) and suspicious IP addresses (as full ranges) that belong to suspicious organizations and that I am sure are not individual users.
Then I remove them from Fail2Ban block list as they are now blocked on an upper level which can't reach here. But something strange happens lately. When I select a few IP addresses and click unban button, the whole server gets inaccessible for a minute or two. None of the websites response for a couple of minutes. Then when the server becomes accesible back, I try removing those IPs again, and most the times it works the second time. So I check a few more IP addresses and click unban again, the server becomes inaccessible again..
What could be causing this, how can I even diagnose it?
If I have an active SSH session, I see that it doesn't get cut off during this time. But if I don't have an active SSH session before I clicked unban button, I cannot make a SSH connection during this time. Isn't that strange?
Then I remove them from Fail2Ban block list as they are now blocked on an upper level which can't reach here. But something strange happens lately. When I select a few IP addresses and click unban button, the whole server gets inaccessible for a minute or two. None of the websites response for a couple of minutes. Then when the server becomes accesible back, I try removing those IPs again, and most the times it works the second time. So I check a few more IP addresses and click unban again, the server becomes inaccessible again..
What could be causing this, how can I even diagnose it?
If I have an active SSH session, I see that it doesn't get cut off during this time. But if I don't have an active SSH session before I clicked unban button, I cannot make a SSH connection during this time. Isn't that strange?
