False positive on SpamHaus
-
@potemkin_ai @DualOSWinWiz one caveat I rediscovered recently (sorry, I forgot this entirely) is this file : https://git.cloudron.io/platform/box/-/blob/master/setup/start/unbound/prefer-ip4.conf?ref_type=heads
We do spamhaus queries via unbound. If your server has IPv6, then older version of unbound might use IPv6 and SpamHaus often fails those queries. From ubuntu 24, there is a flag to tell unbound to prefer ipv4 instead of the ipv6 . Does this situation apply to either of you ? i.e do you have ubuntu < 24 and ipv6 ? if so, this might be the issue
@girish ipv6 has been disabled wherever possible, but it seems like it can't be switched off completely, even with
sysctl
calls.But, yeah - I'm running 22.04 and the config file is not there.
Shall I create one at
/etc/unbound/unbound.conf.d/
? Willsystemctl restart unbound
be sufficient afterwards? -
@girish ipv6 has been disabled wherever possible, but it seems like it can't be switched off completely, even with
sysctl
calls.But, yeah - I'm running 22.04 and the config file is not there.
Shall I create one at
/etc/unbound/unbound.conf.d/
? Willsystemctl restart unbound
be sufficient afterwards? -
@potemkin_ai you have to upgrade ubuntu for that option to work. the old unbound doesn't start with that option .
@girish afraid can't do that at the moment...
I can see that I have unbound 1.13.1 on my Ubuntu.
From the issue discussion at the year 2021 I can see they are discussing that option with unbound 1.13; and unbound 1.13.1 has been released at 9 Feb 2021 - which all leads me to believe that this option could be recognized... Unless I'm missing something?
-
@potemkin_ai @DualOSWinWiz one caveat I rediscovered recently (sorry, I forgot this entirely) is this file : https://git.cloudron.io/platform/box/-/blob/master/setup/start/unbound/prefer-ip4.conf?ref_type=heads
We do spamhaus queries via unbound. If your server has IPv6, then older version of unbound might use IPv6 and SpamHaus often fails those queries. From ubuntu 24, there is a flag to tell unbound to prefer ipv4 instead of the ipv6 . Does this situation apply to either of you ? i.e do you have ubuntu < 24 and ipv6 ? if so, this might be the issue
@girish i have 24.04 and ipv6 is disabled
-
@potemkin_ai @DualOSWinWiz one caveat I rediscovered recently (sorry, I forgot this entirely) is this file : https://git.cloudron.io/platform/box/-/blob/master/setup/start/unbound/prefer-ip4.conf?ref_type=heads
We do spamhaus queries via unbound. If your server has IPv6, then older version of unbound might use IPv6 and SpamHaus often fails those queries. From ubuntu 24, there is a flag to tell unbound to prefer ipv4 instead of the ipv6 . Does this situation apply to either of you ? i.e do you have ubuntu < 24 and ipv6 ? if so, this might be the issue
@girish already
-
@girish finally i figured out the problem it was Unifiy Gateway (it was Using content filtering in order to moderate the traffic and using dns once i turned off that for all turned green and so far since last 3 hours its green.
-
@girish finally i figured out the problem it was Unifiy Gateway (it was Using content filtering in order to moderate the traffic and using dns once i turned off that for all turned green and so far since last 3 hours its green.
@DualOSWinWiz would you mind elaborating how it affected you?
-
so their is a separate feature in Unify gateway to filter content with options None, Work and Family i selected work. the problem was if you select either of Family or Work firewall was migrating traffic to be on open resolver regardless of Network settings. i turned off that feature and it worked out.
-
@DualOSWinWiz , thank you!
@girish , do you have some considerations, based on the information I've provided earlier? -
J jdaviescoates referenced this topic
-
@jdaviescoates said in URGENT:
In a post on an originally unrelated thread about IPv6 issues @Gengar posted this link https://www.spamhaus.com/resource-center/successfully-accessing-spamhauss-free-block-lists-using-a-public-dns/ which I think explains what's going on with all these false positive spamhaus issues people are having:
The TL;DR seems to be: fill in this form https://www.spamhaus.com/free-trial/sign-up-for-a-free-data-query-service-account/
-
@jdaviescoates said in URGENT:
In a post on an originally unrelated thread about IPv6 issues @Gengar posted this link https://www.spamhaus.com/resource-center/successfully-accessing-spamhauss-free-block-lists-using-a-public-dns/ which I think explains what's going on with all these false positive spamhaus issues people are having:
The TL;DR seems to be: fill in this form https://www.spamhaus.com/free-trial/sign-up-for-a-free-data-query-service-account/
@jdaviescoates thank you! I will keep that as a final resort!
@girish , I would much appreciate any additional information to work-out those false positive alerts as they shall be handled - as I highlighted earlier, Ubuntu update doesn't seem to be relevant...
-
P potemkin_ai referenced this topic
-
-
Those are two different issues actually.
-
-
This particular issue is due to the system's configuration which prevents correct spam resolution. Might be the root cause is one, but we can't be sure on that.
-
OK, I don't really understand the difference entirely, but maybe others can help out. Will leave this as unsolved.
-
P potemkin_ai referenced this topic
-