Impossible to block IP 0.0.0.0

  • Resolved ruben101

    (@ruben101)


    10 years, 9 months ago

    Hi,

    I was successfully using Wordfence manual block IP for 0.0.0.0 until today

    I’ve updated Wordfence to 4.03 and now it refuses to submit that IP and says “it is in a range of internal IP addresses that Wordfence does not block.”.

    Even when I tried blocking that IP through Advanced Blocking (putting something like 0.0.0.0 – 0.0.0.1) it is still allowing requests from that IP address to pass.

    And please note, everything was fluent, before update.

    Thanks a lot,
    Ruben

    https://www.ads-software.com/plugins/wordfence/

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Author Wordfence Security

    (@mmaunder)

    Hi Ruben,

    0.0.0.0 is not a valid IP address on the Internet.

    https://en.wikipedia.org/wiki/0.0.0.0

    So your Wordfence is misconfigured. See the option for ‘how wordfence gets ip addresses’ and let me know what that’s set to.

    Regards,

    Mark.

    Thread Starter ruben101

    (@ruben101)

    Hi,

    All options are set to default values.
    How Wordfence gets ip addresses option is set to
    Set this option if you’re seeing visitors from fake IP addresses or who appear to be from your internal network but aren’t.

    And I’ve tried the other 4 options too. None of them working.

    I understand that 0.0.0.0 is not a valid IP address, but my website is facing heavy attack from “An unknown location at IP 0.0.0.0 tried to access…“. And before update to 4.03, Wordfence was able to block that address (it had blocked 700.000 hits from there).

    Thank you very much,
    Ruben

    Plugin Author Wordfence Security

    (@mmaunder)

    Ruben you may have to work with your hosting provider on this one. They’ll explain that 0.0.0.0 is not valid and they might be able to explain why you’re seeing that.

    Regards,

    Mark.

    Mark, I would like to point out that I am getting requests from 0.0.0.0 from “Browser: Amaya
    curl/7.15.5 (x86_64-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5″

    In my case I am behind a reverse proxy and I am sure there is an attempt to spoof the x-forwarded-for header using curl.

    While this has not been critical for me **yet** (I have the real IP in the proxy log file), I am concerned about how Wordfence would handled this scenario under an attack.

    Thanks

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Impossible to block IP 0.0.0.0’ is closed to new replies.