IP removed from Blocklist is not flagged again

Customer support forums for Atomic Protector (formerly Atomic Secured Linux). There is no such thing as a bad question here as long as it pertains to using Atomic Protector. Newbies feel free to get help getting started or asking questions that may be obvious. Regular users are asked to be gentle. :-)
imadsani
Forum Regular
Forum Regular
Posts: 112
Joined: Mon Sep 16, 2013 10:10 am
Location: Lahore

IP removed from Blocklist is not flagged again

Unread post by imadsani »

I've been testing a new server and just noticed that if I manually remove an IP from the Blacklist after having intentionally triggered the WAF, it won't flag the incident from the same IP when I try it again.

So far I've tried this from two different hosts. Once manually removed from Blacklist, ASL will not block the IP again. The same offence, if I try from a completely new IP, it records and blocks it immediately.

Is this by design or a flaw?

ASL version: 4.0.16-21
Webserver: Apache 2.4
DB: MariaDB 10.1.9
OS: CentOS 7.1

Edit: Please disregard. I feel like an idiot. I have Varnish running on port 80 so after the first attempt every other attempt was served by Varnish instead of going to the backend (Apache / ASL). I only discovered this when I, by chance, cleared varnish this morning to test things a second time around.

Sorry guys.
Post Reply