Telecom Transparent Proxies causing problem

Forums › Spark New Zealand (including Skinny and BigPipe) › Telecom Transparent Proxies causing problem

gujal

13 posts

Geek
+1 received by user: 6

#143037 1-Apr-2014 18:45

For the last 2 weeks I have major issues with Telecom Proxies, as they now seem to hide my address totally
CDN sites now see all traffic come from the Proxy IP address instead of the address allocated to my broadband router. As the CDN sites see lot of connections come from a single IP Address, they deem they are under attack and put up a captcha page as below

This is causing pain when not using a browser as the client app just say web page error. Can someone from Telecom please clarify why they are hiding our IP addresses behind proxies

Thanks for the help

1 | 2

BDFL - Memuneh
80658 posts

Uber Geek
+1 received by user: 41071

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1016766 1-Apr-2014 19:55

I am not sure there's a transparent proxy. Your post here on Geekzone comes from New Zealand and one of our rules is to whitelist New Zealand IP addresses. My guess is that this is not a Telecom proxy problem but probably the sites you're accessing have rules that whitelist some countries and require authentication for others.

Likewise if this was true then I'd see a lot of people posting from the same IP. This is not the case, even for your post above.

If you post a list of sites you're having problem we might be able to test with other ISPs and confirm.

If you go to testip.geekzone.co.nz what's the IP you see?

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

Inphinity

2780 posts

Uber Geek
+1 received by user: 1184

#1016789 1-Apr-2014 20:18

Are you using any counter-geolocation services, like UnblockUS etc?
I'm with Telecom and have no issues.

gujal

13 posts

Geek
+1 received by user: 6

#1017166 2-Apr-2014 13:19

Thanks for the replies.
No, I am not using any counter geolocation services. I am on stock standard Telecom VDSL connection with Telecom provided Technicolor Router with default configuration. Also the captcha page from cloudflare was intermittent, sometimes it will work correctly and sometimes will pop up with captcha page.

After my post yesterday something has changed quietly. I am now able to see my IP Address correctly when I visit whatismyip.com or testip.geekzone.co.nz and no more cloudflare alerts!

Earlier when I visited whatismyip I was seeing the same address as reported by Cloudflare 210.55.212.xx which is a registered range to Telecom but not on my router as below

Your IP:210.55.212.75

Proxy:No Proxy Detected

City:christchurch

State/Region:canterbury

Country:nz -

ISP:netway communications ltd

The last octet on the IP address was changing, i did see about 3 different numbers (just the last octet) during my tests.

Will update if things change again. Everything is working fine now.

loathe

58 posts

Master Geek
+1 received by user: 5

#1017181 2-Apr-2014 13:47

Exact same problem here, see my caching issues thread. I see gujal you responded there too.

freitasm, geekzone's test ip page brings up the same ip as assigned to my router, however whats my ip gives the same range as gujal has indicated above, 210.55.212.xxx. This has all started in the last two weeks.

gujal, did you change anything specifically? honestly, this is a real pain.

Telecom??

Thanks

plambrechtsen

1948 posts

Uber Geek
+1 received by user: 459
Inactive user

#1017285 2-Apr-2014 15:35

There is a transparent proxy in place, but if you are using HTTPS then it completely avoids this.

Does using HTTPS resolve it, and which site are going to, I assume ilive.to or something else?

loathe

58 posts

Master Geek
+1 received by user: 5

#1017425 2-Apr-2014 18:18

plambrechtsen: There is a transparent proxy in place, but if you are using HTTPS then it completely avoids this.

Does using HTTPS resolve it, and which site are going to, I assume ilive.to or something else?

Hi, thanks for this.

What has changed in the past two weeks to cause these issues? Can a customer elect to not be behind the transparent proxy?

Mighty Ape

Shop now at Mighty Ape (affiliate link).

Ragnor

8279 posts

Uber Geek
+1 received by user: 585

Trusted

#1017433 2-Apr-2014 18:28

If I recall correctly most domestic http doesn't go via the transparent proxy cluster just international.

Telecom haven't changed anything, Cloudflare have probably listed the the ip addresses/range used by the proxy as requiring this authentication step for some reason.

ilive is using the Cloudflare CDN/optimizer so it's probably their WAF settings
https://www.cloudflare.com/waf

Best course of action is to contact ilive and ask them to remove the WAF listing on these addresses in their Cloudflare control panel.

gujal

13 posts

Geek
+1 received by user: 6

#1017486 2-Apr-2014 19:52

@plambrechtsen

ilive.to is just one of them, there are others such as watchsuntv.com, yupptv.com. All these are streaming video sites and use CDN and do not use HTTPS, so unfortunately using HTTPS is not an option

@loathe
I havent done anything, didn't even restart my router, it was working fine since morning and I was getting my router ip address if I visit whatismyip.com.

Now back to square one, may be more people are visiting sites behind cloudflare in the evening and cloudflare starts alerting as it sees lot more connections coming from the same IP.

This is what I get now.
CloudFlare Ray ID: 114b2e3d9c430b26 • Your IP: 210.55.212.81 • Help • Performance & security by CloudFlare

freitasm

BDFL - Memuneh
80658 posts

Uber Geek
+1 received by user: 41071

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1017623 3-Apr-2014 08:08

Cloudflare will activate the captcha if there are suspicious activities from an IP or neighbouring addresses. A big chunk of Telecom's traffic coming through a single IP will likely have some botnets, DDoS participants (think slow connection attacks, not amplification ones) and so on.

It doesn't happen on Geekzone because we whitelisted New Zealand, otherwise it would happen too.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

matkins111

4 posts

Wannabe Geek

#1023006 10-Apr-2014 16:55

Hey Guys

Definately some strange activity going on with Telecom international port 80 traffic

I manage a few dozen PBX's in NZ with most running on Telecom circuits.

Each site has a dynamic IP so I use dyndns.

Over the past couple of weeks i've been having trouble gaining access to an increasing amount of them and I suspected there was a change with Dyndns which was causing update issues.

That is until I read the update logs:

10/04/2014 16:37 210.55.212.88 system=dyndns ddclient/3.6.7 good 210.55.212.88
10/04/2014 16:36 210.55.212.83 system=dyndns ddclient/3.6.7 good 210.55.212.83
10/04/2014 16:36 210.55.212.187 system=dyndns ddclient/3.6.7 good 210.55.212.187
10/04/2014 16:36 210.55.212.175 system=dyndns ddclient/3.6.7 good 210.55.212.175
10/04/2014 16:35 210.55.212.153 system=dyndns ddclient/3.6.7 good 210.55.212.153
10/04/2014 16:35 210.55.212.25 system=dyndns ddclient/3.6.7 good 210.55.212.25
10/04/2014 16:34 210.55.212.247 system=dyndns ddclient/3.6.7 good 210.55.212.247
10/04/2014 16:34 210.55.212.79 system=dyndns ddclient/3.6.7 good 210.55.212.79
10/04/2014 16:33 210.55.212.64 system=dyndns ddclient/3.6.7 good 210.55.212.64
10/04/2014 16:33 210.55.212.160 system=dyndns ddclient/3.6.7 good 210.55.212.160
10/04/2014 16:33 210.55.212.141 system=dyndns ddclient/3.6.7 good 210.55.212.141
10/04/2014 16:33 210.55.212.245 system=dyndns ddclient/3.6.7 good 210.55.212.245
10/04/2014 16:33 210.55.212.118 system=dyndns ddclient/3.6.7 good 210.55.212.118
10/04/2014 16:33 210.55.212.71 system=dyndns ddclient/3.6.7 good 210.55.212.71
10/04/2014 16:33 210.55.212.4 system=dyndns ddclient/3.6.7 good 210.55.212.4
10/04/2014 16:33 210.55.212.134 system=dyndns ddclient/3.6.7 good 210.55.212.134
10/04/2014 16:33 210.55.212.162 system=dyndns ddclient/3.6.7 good 210.55.212.162
10/04/2014 16:33 210.55.212.130 system=dyndns ddclient/3.6.7 good 210.55.212.130
10/04/2014 16:33 210.55.212.51 system=dyndns ddclient/3.6.7 good 210.55.212.51
10/04/2014 16:33 210.55.212.144 system=dyndns ddclient/3.6.7 good 210.55.212.144
10/04/2014 16:32 210.55.212.92 system=dyndns ddclient/3.6.7 good 210.55.212.92
10/04/2014 16:31 210.55.212.124 system=dyndns ddclient/3.6.7 good 210.55.212.124
10/04/2014 16:31 210.55.212.214 system=dyndns ddclient/3.6.7 good 210.55.212.214
10/04/2014 16:31 210.55.212.73 system=dyndns ddclient/3.6.7 good 210.55.212.73
10/04/2014 16:28 210.55.212.227 system=dyndns ddclient/3.6.7 good 210.55.212.227
10/04/2014 16:28 210.55.212.151 system=dyndns ddclient/3.6.7 good 210.55.212.151
10/04/2014 16:28 210.55.212.129 system=dyndns ddclient/3.6.7 good 210.55.212.129
10/04/2014 16:28 210.55.212.45 system=dyndns ddclient/3.6.7 good 210.55.212.45
10/04/2014 16:28 210.55.212.82 system=dyndns ddclient/3.6.7 good 210.55.212.82
10/04/2014 16:28 210.55.212.114 system=dyndns ddclient/3.6.7 good 210.55.212.114
10/04/2014 16:28 210.55.212.238 system=dyndns ddclient/3.6.7 good 210.55.212.238
10/04/2014 16:28 210.55.212.84 system=dyndns ddclient/3.6.7 good 210.55.212.84
10/04/2014 16:26 210.55.212.175 system=dyndns ddclient/3.6.7 good 210.55.212.175
10/04/2014 16:26 210.55.212.67 system=dyndns ddclient/3.6.7 good 210.55.212.67
10/04/2014 16:23 122.61.61.1 system=dyndns ddclient/3.6.7 good 122.61.61.1
10/04/2014 16:23 210.55.212.147 system=dyndns ddclient/3.6.7 good 210.55.212.147
10/04/2014 16:23 122.61.42.131 system=dyndns ddclient/3.7.3 good 122.61.42.131
10/04/2014 16:23 122.59.239.61 system=dyndns ddclient/3.6.7 good 122.59.239.61
10/04/2014 16:23 122.57.61.190 system=dyndns ddclient/3.6.7 good 122.57.61.190
10/04/2014 16:23 210.55.212.103 system=dyndns ddclient/3.6.7 good 210.55.212.103
10/04/2014 16:23 210.55.212.47 system=dyndns ddclient/3.6.7 good 210.55.212.47
10/04/2014 16:23 210.55.212.59 system=dyndns ddclient/3.6.7 good 210.55.212.59
10/04/2014 16:23 210.55.212.32 system=dyndns ddclient/3.6.7 good 210.55.212.32
10/04/2014 16:23 210.55.212.219 system=dyndns ddclient/3.6.7 good 210.55.212.219
10/04/2014 16:23 210.55.212.208 system=dyndns ddclient/3.6.7 good 210.55.212.208
10/04/2014 16:21 210.55.212.74 system=dyndns ddclient/3.6.7 good 210.55.212.74
10/04/2014 16:21 210.55.212.202 system=dyndns ddclient/3.6.7 good 210.55.212.202
10/04/2014 16:20 122.57.60.67 system=dyndns ddclient/3.6.7 good 122.57.60.67
10/04/2014 16:18 222.155.25.81 system=dyndns ddclient/3.6.7 good 222.155.25.81
10/04/2014 16:18 210.55.212.240 system=dyndns ddclient/3.6.7 good 210.55.212.240
10/04/2014 16:18 210.55.212.192 system=dyndns ddclient/3.7.3 good 210.55.212.192
10/04/2014 16:18 210.55.212.36 system=dyndns ddclient/3.6.7 good 210.55.212.36
10/04/2014 16:18 210.55.212.208 system=dyndns ddclient/3.6.7 good 210.55.212.208
10/04/2014 16:18 210.55.212.232 system=dyndns ddclient/3.6.7 good 210.55.212.232
10/04/2014 16:18 210.55.212.51 system=dyndns ddclient/3.6.7 good 210.55.212.51
10/04/2014 16:18 210.55.212.45 system=dyndns ddclient/3.6.7 good 210.55.212.45
10/04/2014 16:18 210.55.212.172 system=dyndns ddclient/3.6.7 good 210.55.212.172
10/04/2014 16:18 210.55.212.147 system=dyndns ddclient/3.6.7 good 210.55.212.147
10/04/2014 16:15 122.59.204.165 system=dyndns ddclient/3.6.7 good 122.59.204.165
10/04/2014 16:15 210.55.212.56 system=dyndns ddclient/3.6.7 good 210.55.212.56
10/04/2014 16:13 125.238.20.30 system=dyndns ddclient/3.6.7 good 125.238.20.30
10/04/2014 16:13 122.61.42.131 system=dyndns ddclient/3.7.3 good 122.61.42.131
10/04/2014 16:13 222.153.139.142 system=dyndns ddclient/3.6.7 good 222.153.139.142
10/04/2014 16:13 122.59.239.61 system=dyndns ddclient/3.6.7 good 122.59.239.61
10/04/2014 16:13 210.55.212.215 system=dyndns ddclient/3.6.7 good 210.55.212.215
10/04/2014 16:13 210.55.212.196 system=dyndns ddclient/3.6.7 good 210.55.212.196
10/04/2014 16:13 210.55.212.34 system=dyndns ddclient/3.6.7 good 210.55.212.34
10/04/2014 16:13 210.55.212.99 system=dyndns ddclient/3.6.7 good 210.55.212.99
10/04/2014 16:13 210.55.212.177 system=dyndns ddclient/3.6.7 good 210.55.212.177
10/04/2014 16:13 210.55.212.18 system=dyndns ddclient/3.6.7 good 210.55.212.18
10/04/2014 16:12 219.89.140.142 system=dyndns ddclient/3.6.7 good 219.89.140.142
10/04/2014 16:11 210.55.212.7 system=dyndns ddclient/3.6.7 good 210.55.212.7
10/04/2014 16:11 122.57.74.8 system=dyndns ddclient/3.6.7 good 122.57.74.8
10/04/2014 16:10 210.55.212.238 system=dyndns ddclient/3.6.7 good 210.55.212.238
10/04/2014 16:10 122.57.60.67 system=dyndns ddclient/3.6.7 good 122.57.60.67
10/04/2014 16:08 210.55.212.243 system=dyndns ddclient/3.6.7 good 210.55.212.243
10/04/2014 16:08 210.55.212.246 system=dyndns ddclient/3.6.7 good 210.55.212.246
10/04/2014 16:08 210.55.212.111 system=dyndns ddclient/3.6.7 good 210.55.212.111
10/04/2014 16:08 210.55.212.32 system=dyndns ddclient/3.7.3 good 210.55.212.32
10/04/2014 16:08 210.55.212.122 system=dyndns ddclient/3.6.7 good 210.55.212.122
10/04/2014 16:08 210.55.212.48 system=dyndns ddclient/3.6.7 good 210.55.212.48
10/04/2014 16:08 210.55.212.72 system=dyndns ddclient/3.6.7 good 210.55.212.72
10/04/2014 16:08 210.55.212.181 system=dyndns ddclient/3.6.7 good 210.55.212.181
10/04/2014 16:08 122.61.17.29 system=dyndns ddclient/3.6.7 good 122.61.17.29
10/04/2014 16:08 222.153.236.14 system=dyndns ddclient/3.6.7 good 222.153.236.14
10/04/2014 16:08 125.238.97.10 system=dyndns ddclient/3.6.7 good 125.238.97.10
10/04/2014 16:07 210.55.212.219 system=dyndns ddclient/3.6.7 good 210.55.212.219
10/04/2014 16:06 210.55.212.15 system=dyndns ddclient/3.6.7 good 210.55.212.15
10/04/2014 16:06 210.55.212.167 system=dyndns ddclient/3.6.7 good 210.55.212.167
10/04/2014 16:06 210.55.212.164 system=dyndns ddclient/3.6.7 good 210.55.212.164
10/04/2014 16:05 210.55.212.136 system=dyndns ddclient/3.6.7 good 210.55.212.136
I've removed the DNS names but as you can see they're all updating with IP's in the range 210.55.212.x. And the IP keeps changing every 5 minutes for each site.

I'm going to ask one of the sites to run both a national and international IP checker but won't be able to until tomorrow.

Can anyone from Telecom shed some light on this?

Cheers
Matt

freitasm

BDFL - Memuneh
80658 posts

Uber Geek
+1 received by user: 41071

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1023011 10-Apr-2014 16:58

You know Dyn is discontinuing their free dynamic DNS too, right?

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

Lego

Shop now for Lego sets and other gifts (affiliate link).

freitasm

BDFL - Memuneh
80658 posts

Uber Geek
+1 received by user: 41071

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1023032 10-Apr-2014 17:48

Also not saying there isn't a problem, just a reminder seeing you use the dynamic service.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

matkins111

4 posts

Wannabe Geek

#1023100 10-Apr-2014 20:34

Yep aware of that. I'm using the paid version

matkins111

4 posts

Wannabe Geek

#1023101 10-Apr-2014 20:36

If there is someone out there on standard Telecom xDSL who could try browsing to checkip.dyndns.comand see whether they get an address in the 210.55.212.x range, that would be appreciated.

GregV

932 posts

Ultimate Geek
+1 received by user: 304

#1023137 10-Apr-2014 21:49

Telecom VDSL - default Telecom router - Current IP Address: 222.155.204.xxx

1 | 2