DaveInUK
Posts: 25
Joined: Sat Dec 21, 2019 11:07 am
Location: Near Bath in the UK.

A very basic question on IP addresses

Mon May 11, 2020 11:04 am

I know that my server has an Internal IP address on my router internal network, of the form 'localhost' or '127.0.01', and that this is not a unique IP address.

I also know that I have a unique External IP , which points to my router and is ported to my server via port 80.

Therefore, when reading internet documents about setting up fail2ban defaults, I'm not surprised that IP 127.0.0.1 is mentioned, because it's not unique to me.

But, when reading a very informative website, I am amazed to find my External IP address quoted!

Code: Select all

In a section headed [DEFAULTS}
it states,
ignoreip = 127.0.0.1  31.125.xx.xx
bantime = etc...etc..

Where "31.125.xx.xx" is MY External IP address!

How is this possible, or is my understanding of unique IP addresses completely wrong?

p.s. I'm not being precious about publishing my IP address, it's just that I get 100's of hacking attempts on my server already and I don't want to add to it unnecessarily.

Cheers
Dave
Cheers,
Dave

I'm feeling optimistic, but I'm sure something with go wrong :!:

User avatar
B.Goode
Posts: 10725
Joined: Mon Sep 01, 2014 4:03 pm
Location: UK

Re: A very basic question on IP addresses

Mon May 11, 2020 12:03 pm

DaveInUK wrote:
Mon May 11, 2020 11:04 am
I know that my server has an Internal IP address on my router internal network, of the form 'localhost' or '127.0.01', and that this is not a unique IP address.

I also know that I have a unique External IP , which points to my router and is ported to my server via port 80.

Therefore, when reading internet documents about setting up fail2ban defaults, I'm not surprised that IP 127.0.0.1 is mentioned, because it's not unique to me.

But, when reading a very informative website, I am amazed to find my External IP address quoted!

Code: Select all

In a section headed [DEFAULTS}
it states,
ignoreip = 127.0.0.1  31.125.xx.xx
bantime = etc...etc..

Where "31.125.xx.xx" is MY External IP address!

How is this possible, or is my understanding of unique IP addresses completely wrong?

p.s. I'm not being precious about publishing my IP address, it's just that I get 100's of hacking attempts on my server already and I don't want to add to it unnecessarily.

Cheers
Dave


A couple of guesses. Either or both could be wide of the mark...

1. You are reading a 'smart' (ie adaptive) website that self-modifies to insert the live external IP address of the host from which it is being accessed, thus giving you accurate realtime information about how to configure fail2ban.


2. The example address used to belong to the author of the website in question but has been reallocated to you by the ISP. (Or maybe it was always a dynamic assignment that was subject to change.)

DaveInUK
Posts: 25
Joined: Sat Dec 21, 2019 11:07 am
Location: Near Bath in the UK.

Re: A very basic question on IP addresses

Mon May 11, 2020 12:42 pm

by B.Goode » Mon May 11, 2020 12:03 pm
A couple of guesses. Either or both could be wide of the mark...

1. You are reading a 'smart' (ie adaptive) website that self-modifies to insert the live external IP address of the host from which it is being accessed, thus giving you accurate realtime information about how to configure fail2ban.
I think this is the most likely answer.
I've looked at the source code of the website but obviously, I can't tell if my address was typed-in or alternatively inserted with (say) php code server-side?

Anyway, thanks for the suggestions, at least .....
  • My understanding of IP addresses is correct
  • I'm not going mad!!!
Cheers
Dave
Cheers,
Dave

I'm feeling optimistic, but I'm sure something with go wrong :!:

User avatar
mooblie
Posts: 220
Joined: Fri Oct 14, 2016 2:07 pm
Location: The Scottish Highlands

Re: A very basic question on IP addresses

Mon May 11, 2020 6:42 pm

If your address seems to appear on a public website, why not post that website address here, and let us all try it?

User avatar
DougieLawson
Posts: 40184
Joined: Sun Jun 16, 2013 11:19 pm
Location: A small cave in deepest darkest Basingstoke, UK
Contact: Website Twitter

Re: A very basic question on IP addresses

Mon May 11, 2020 7:39 pm

I had these addresses in the ignoreip list

Code: Select all

ignoreip = 127.0.0.1/8 192.168.3.0/24 10.8.0.0/24 41.193.164.0/24 90.155.53.0/24 104.129.198.0/24 62.232.154.0/24 115.70.179.0/24 5.2.108.163
As they are/were the addresses of various hotels and stuff that I've visited round the world where I want to run an ssh session but don't want to get blocked. First three address blocks are the whole loopback subnet, my local LAN and my OpenVPN tunnel. I've trimmed that list down to just those three right now (as I'm not planning to travel anywhere before November).
Criticising any questions is banned on this forum.

Any DMs sent on Twitter will be answered next month.
All fake doctors are on my foes list.

Note: Any requirement to use a crystal ball or mind reading will result in me ignoring your question.

DaveInUK
Posts: 25
Joined: Sat Dec 21, 2019 11:07 am
Location: Near Bath in the UK.

Re: A very basic question on IP addresses

Fri May 15, 2020 12:13 pm

mooblie wrote:
Mon May 11, 2020 6:42 pm
If your address seems to appear on a public website, why not post that website address here, and let us all try it?
Here is the website I mentioned.

Code: Select all

https://www.the-art-of-web.com/system/fail2ban-howto/?hilite=fail2ban+filter
In the first section on "Modifying the jail.conf file" does the line " ignoreip = 127.0.0.1 ...." include your IP address?
Cheers,
Dave

I'm feeling optimistic, but I'm sure something with go wrong :!:

User avatar
B.Goode
Posts: 10725
Joined: Mon Sep 01, 2014 4:03 pm
Location: UK

Re: A very basic question on IP addresses

Fri May 15, 2020 12:18 pm

DaveInUK wrote:
Fri May 15, 2020 12:13 pm
mooblie wrote:
Mon May 11, 2020 6:42 pm
If your address seems to appear on a public website, why not post that website address here, and let us all try it?
Here is the website I mentioned.

Code: Select all

https://www.the-art-of-web.com/system/fail2ban-howto/?hilite=fail2ban+filter
In the first section on "Modifying the jail.conf file" does the line " ignoreip = 127.0.0.1 ...." include your IP address?


Seems to confirm what I wrote -
You are reading a 'smart' (ie adaptive) website that self-modifies to insert the live external IP address of the host from which it is being accessed, thus giving you accurate realtime information about how to configure fail2ban.

DaveInUK
Posts: 25
Joined: Sat Dec 21, 2019 11:07 am
Location: Near Bath in the UK.

Re: A very basic question on IP addresses

Fri May 15, 2020 12:20 pm

DougieLawson wrote:
Mon May 11, 2020 7:39 pm
I had these addresses in the ignoreip list

Code: Select all

ignoreip = 127.0.0.1/8 192.168.3.0/24 10.8.0.0/24 41.193.164.0/24 90.155.53.0/24 104.129.198.0/24 62.232.154.0/24 115.70.179.0/24 5.2.108.163
As they are/were the addresses of various hotels and stuff that I've visited round the world where I want to run an ssh session but don't want to get blocked. First three address blocks are the whole loopback subnet, my local LAN and my OpenVPN tunnel. I've trimmed that list down to just those three right now (as I'm not planning to travel anywhere before November).
Thanks for the suggestion but I was only interested in the fact that my IP address appeared on a website, which (thanks to B.Goode) is obvious in hindsight :oops:
Cheers,
Dave

I'm feeling optimistic, but I'm sure something with go wrong :!:

User avatar
mooblie
Posts: 220
Joined: Fri Oct 14, 2016 2:07 pm
Location: The Scottish Highlands

Re: A very basic question on IP addresses

Sat May 16, 2020 6:10 am

DaveInUK wrote:
Fri May 15, 2020 12:13 pm
mooblie wrote:
Mon May 11, 2020 6:42 pm
If your address seems to appear on a public website, why not post that website address here, and let us all try it?
Here is the website I mentioned.

Code: Select all

https://www.the-art-of-web.com/system/fail2ban-howto/?hilite=fail2ban+filter
In the first section on "Modifying the jail.conf file" does the line " ignoreip = 127.0.0.1 ...." include your IP address?
Yep, that site includes my own current external IP address, as you suspected, too.

Return to “Networking and servers”