No internet connectivity when phorm.com is blocked (split from monster phorm thread) - Page 2

punky · 18-04-2008, 14:43

Tracing those 3 IPs, I can't see a link to Phorm.

88.208.250.66 > live-servers.net > Fasthosts
88.208.250.85 > live-servers.net > Fasthosts
207.44.186.90 > ThePlanet

So i'm guessing sites not hosted or routed through those companies should still work?

Heed · 18-04-2008, 14:47

Quote:

Originally Posted by The Jackal

Can you post your complete network settings please - I'm interested in what DNS servers you are using.

windoze ipconfig /all

linux ifconfig -a && cat /etc/hosts

I'd like to test this out.

Cheers

---------- Post added at 14:41 ---------- Previous post was at 14:40 ----------

What settings are you using ? tcp/udp drop incoming or outcoming packets from phrom.com ?

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Heed>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : xxxxxxxxx
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : NVIDIA nForce Networking Controller
Physical Address. . . . . . . . . : xxxxxxxxxxxxxxx
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : xxxxxxxxx Mod edit (Gavin): IP address removed for your security.
Subnet Mask . . . . . . . . . . . : 255.255.252.0
Default Gateway . . . . . . . . . : 82.11.28.1
DHCP Server . . . . . . . . . . . : 62.254.64.20
DNS Servers . . . . . . . . . . . : 194.168.4.100
194.168.8.100
NetBIOS over Tcpip. . . . . . . . : Disabled
Lease Obtained. . . . . . . . . . : 18 April 2008 09:33:37
Lease Expires . . . . . . . . . . : 23 April 2008 11:24:13

C:\Documents and Settings\Heed>

As for settings, I'm not sure. Comodo just allows you specify an address, a range or a domain name. I believe it's simply blocking all communication with the domain/I.P. that's listed.

punky · 18-04-2008, 14:48

which hosts did you get those IPs from? webwise.com or something?

Heed · 18-04-2008, 14:48

Quote:

Originally Posted by Gavin

Tracing those 3 IPs, I can't see a link to Phorm.

88.208.250.66 > live-servers.net > Fasthosts
88.208.250.85 > live-servers.net > Fasthosts
207.44.186.90 > ThePlanet

So i'm guessing sites not hosted or routed through those companies should still work?

Those I.P's came from here:

http://www.all-nettools.com/toolbox

NsLookup

punky · 18-04-2008, 14:57

Yeah, but what hostnames did you lookup to get those IPs?

webwise.com does resolve to 88.208.250.66, but I think that's for the webhosting rather anything else. There are probably other hosts that resolve there (that Fasthosts are hosting)

The Jackal · 18-04-2008, 14:58

Have you tried using a non ntl DNS server instead ?

If you're looking at anonymity/getting away from phorm then why the heck are you using ntl name servers ?

Use someone elses and retest - let us know how you get on

Heed · 18-04-2008, 15:08

Quote:

Originally Posted by Gavin

Yeah, but what hostnames did you lookup to get those IPs?

webwise.com does resolve to 88.208.250.66, but I think that's for the webhosting rather anything else. There are probably other hosts that resolve there (that Fasthosts are hosting)

Oh, phorm.com.

Those are IP's that have been passed around in the big phorm thread.

But really, the relevant point is that blocking the phorm.com domain leads me to have no connectivity.

---------- Post added at 15:02 ---------- Previous post was at 14:59 ----------

Quote:

Originally Posted by The Jackal

Have you tried using a non ntl DNS server instead ?

If you're looking at anonymity/getting away from phorm then why the heck are you using ntl name servers ?

Use someone elses and retest - let us know how you get on

No, I haven't.

You have any handy?

As for why, well I didn't think I would need to switch DNS servers in order to avoid phorm.

---------- Post added at 15:08 ---------- Previous post was at 15:02 ----------

Okay, I switched to OpenDNS servers and have functionality with phorm.com blocked.

What does this tell us?

The Jackal · 18-04-2008, 15:08

Quote:

Originally Posted by Heed

No, I haven't.

You have any handy?

As for why, well I didn't think I would need to switch DNS servers in order to avoid phorm.

thut thut

If I were in charge I would make all your DNS requests run through virgin's poisioned DNS servers and borg the lot of you. Phorm is good for you

For that matter re-route every tcp/udp request on port 53.

The only people I can't handle are people like myself who route all traffic through an ssh tunnel bounced through either new york or london.

Some DNS servers for you do a whois.net and pick one of the billions of open DNS servers....

nslookup
> server NS1.UK2.NET
Default server: NS1.UK2.NET
Address: 83.170.64.2#53
> news.bbc.co.uk
Server: NS1.UK2.NET
Address: 83.170.64.2#53

Non-authoritative answer:
news.bbc.co.uk canonical name = newswww.bbc.net.uk.
Name: newswww.bbc.net.uk
Address: 212.58.226.29
>

punky · 18-04-2008, 15:10

I think blocking those IPs block all/large amounts of servers run by Fasthosts and ThePlanet. Loads of hostnames will resolve to those IPs.

Can you block by hostname instead?

The Jackal · 18-04-2008, 15:11

ps Can you give the firewall rules that you are using to block

#88.208.248.102 - 88.208.250.85

That's virtually 3 class C's that you are trying to block maybe you have your netmask screwed.

Heed · 18-04-2008, 15:20

Please forget about IP's for a second -- I've had those blocked for over a week with no problems and now only have phorm.com blocked.

As I said above, switching to OpenDNS servers gives me connectivity back when phorm.com is blocked.

---------- Post added at 15:16 ---------- Previous post was at 15:14 ----------

Quote:

Originally Posted by Gavin

Can you block by hostname instead?

Yes, that's when I encounter problems and that's the only block in place right now -- "phorm.com".

---------- Post added at 15:20 ---------- Previous post was at 15:16 ----------

Quote:

Originally Posted by Gavin

NTL's/VM's DNS servers never have been a lot of cop.

I would say on the basis of your post alone that VM's DNS servers are cross-referencing with Phorm. However, i'd say it needs more investigation to be conclusive.

Yes, that seems most likely. I originally thought it was a DNS problem (described in my first post) because it looks just like one.

But what can we make out of every DNS lookup being bounced to somewhere in phorm.com? Is that part of the tech spec. on this equipment?

EDIT: And wait a minute. Phorm kit is not even supposed to be on VM's network, right? I'm sure I've seen VM responses that they are "still evaluating" and have no kit in place yet. Someone correct me if I'm wrong and VM haven't denied the kit is in-place/has been trialed/will be trialed.

Bonglet · 18-04-2008, 15:26

I would say so as when its in place and has been mentioned in other peoples post's you cant escape phorms kit as it goes through it, might be perfectly simple explination but as i keep stating keep as much info as you can (for all you know you could be in a secret trial or otherwise) and have no protection for liabel damages at a future date, however secretive phorms kit is.

The Jackal · 18-04-2008, 15:28

Well I gave this a try

#$iptables -I POSTROUTING -t nat -s 0/0 -d 88.208.248.0/24 -p all -j DROP -v
#$iptables -I POSTROUTING -t nat -s 0/0 -d 88.208.249.0/24 -p all -j DROP -v
#$iptables -I POSTROUTING -t nat -s 0/0 -d 88.208.250.0/24 -p all -j DROP -v

And all seems to work so I'm still with the dodgy DNS servers theory. Block phorm should not block internet access completely.

Bonglet · 18-04-2008, 15:29

would be interesting to know if other people in your area are having this same issue also.

Heed · 18-04-2008, 15:31

Quote:

Originally Posted by The Jackal

Well I gave this a try

#$iptables -I POSTROUTING -t nat -s 0/0 -d 88.208.248.0/24 -p all -j DROP -v
#$iptables -I POSTROUTING -t nat -s 0/0 -d 88.208.249.0/24 -p all -j DROP -v
#$iptables -I POSTROUTING -t nat -s 0/0 -d 88.208.250.0/24 -p all -j DROP -v

And all seems to work so I'm still with the dodgy DNS servers theory. Block phorm should not block internet access completely.

I would be more than happy to put it down to something innocent like poor NTL DNS servers, but I can't escape the fact that several dozen times I have switched from blocking/unblocking phorm.com and each time it resulted in no connectivity (block) and connectivity (unblocked) when using the default NTL DNS servers. That can't be a coincidence, can it?