Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a VPS, after a DDos attack, the service provider disabled my server until the attack finished. After recovering from the DDos, the main IP is not accessible at all! I don't know where to look. Here is the result of iptables -L -v -n --line-numbers

(first three octets changed to XXX)

Chain INPUT (policy ACCEPT 4917K packets, 412M bytes)
num   pkts bytes target     prot opt in     out     source               destination
1    4916K  412M acctboth   all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 12M packets, 3644M bytes)
num   pkts bytes target     prot opt in     out     source               destination
1      12M 3644M acctboth   all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain acctboth (2 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0            tcp  --  !lo    *       XXX.XXX.XXX.94          0.0.0.0/0           tcp dpt:80
2        0     0            tcp  --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.94         tcp spt:80
3        0     0            tcp  --  !lo    *       XXX.XXX.XXX.94          0.0.0.0/0           tcp dpt:25
4        0     0            tcp  --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.94         tcp spt:25
5        0     0            tcp  --  !lo    *       XXX.XXX.XXX.94          0.0.0.0/0           tcp dpt:110
6        0     0            tcp  --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.94         tcp spt:110
7        8   672            icmp --  !lo    *       XXX.XXX.XXX.94          0.0.0.0/0
8        8   672            icmp --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.94
9        0     0            tcp  --  !lo    *       XXX.XXX.XXX.94          0.0.0.0/0
10       0     0            tcp  --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.94
11    4962  342K            udp  --  !lo    *       XXX.XXX.XXX.94          0.0.0.0/0
12       0     0            udp  --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.94
13    4970  343K            all  --  !lo    *       XXX.XXX.XXX.94          0.0.0.0/0
14       8   672            all  --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.94
15       0     0            tcp  --  !lo    *       XXX.XXX.XXX.95          0.0.0.0/0           tcp dpt:80
16       0     0            tcp  --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.95         tcp spt:80
17       0     0            tcp  --  !lo    *       XXX.XXX.XXX.95          0.0.0.0/0           tcp dpt:25
18       0     0            tcp  --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.95         tcp spt:25
19       0     0            tcp  --  !lo    *       XXX.XXX.XXX.95          0.0.0.0/0           tcp dpt:110
20       0     0            tcp  --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.95         tcp spt:110
21       0     0            icmp --  !lo    *       XXX.XXX.XXX.95          0.0.0.0/0
22       0     0            icmp --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.95
23    2180 2474K            tcp  --  !lo    *       XXX.XXX.XXX.95          0.0.0.0/0
24    1932  142K            tcp  --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.95
25     149 22850            udp  --  !lo    *       XXX.XXX.XXX.95          0.0.0.0/0
26     149 11157            udp  --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.95
27    2329 2497K            all  --  !lo    *       XXX.XXX.XXX.95          0.0.0.0/0
28    2081  153K            all  --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.95
29       0     0            tcp  --  !lo    *       XXX.XXX.XXX.96          0.0.0.0/0           tcp dpt:80
30       0     0            tcp  --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.96         tcp spt:80
31       0     0            tcp  --  !lo    *       XXX.XXX.XXX.96          0.0.0.0/0           tcp dpt:25
32       0     0            tcp  --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.96         tcp spt:25
33       0     0            tcp  --  !lo    *       XXX.XXX.XXX.96          0.0.0.0/0           tcp dpt:110
34       0     0            tcp  --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.96         tcp spt:110
35       0     0            icmp --  !lo    *       XXX.XXX.XXX.96          0.0.0.0/0
36       0     0            icmp --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.96
37       4   160            tcp  --  !lo    *       XXX.XXX.XXX.96          0.0.0.0/0
38       4   192            tcp  --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.96
39       2   562            udp  --  !lo    *       XXX.XXX.XXX.96          0.0.0.0/0
40       2   164            udp  --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.96
41       6   722            all  --  !lo    *       XXX.XXX.XXX.96          0.0.0.0/0
42       6   356            all  --  !lo    *       0.0.0.0/0            XXX.XXX.XXX.96
43    9704 3051K            all  --  !lo    *       0.0.0.0/0            0.0.0.0/0

The main IP xxx.xxx.xxx.94 is not accessible (no pings, tracert, http, ...) while .95 and .96 are accessible.

Where else should I look for ip-blocking rules?

Note: I run WHM on the main IP.

share|improve this question
    
You need to get your provider to undo whatever they did that disabled the IP. –  David Schwartz Sep 15 '13 at 22:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.