MyBB Community Forums

Full Version: Banning doesn't work
You're currently viewing a stripped down version of our content. View the full version with proper formatting.
Pages: 1 2
Hi,

Strange thing happening. Every time I try to ban someone by IP, the board bans me (the admin) as well.

Any idea? Using the latest version of MyBB.
Working fine on my site, I think you should wait and get some advice from the support/development team on this one.
A guide from Adam Kalsey: (why ip banning is useless...)


Quote:Many proposals for eliminating comment spam are focused on banning or throttling comments from the IP address of the spammer. This is fundamentally flawed because it assumes IP addresses are both unique and hard to come by.

Banning an IP address can have severe consequences. Many ISPs (including AOL) and companies use a proxy server that makes it appear as if all users are coming from a single (or a handful) if IP addresses. By blocking an IP address, you might be preventing a substantial portion of AOL users from commenting. Depending on your point of view, eliminating AOL may not be a great loss; however the same thing would happen to millions of users behind other proxy servers.

The other problem is that IP addresses are very easy to get or fake for spammers who care about such things. There are hundreds of thousands of open proxies that will let anyone direct Web traffic through them. When I’m using an open proxy, my IP address is effectively masked. And I can use simple software to switch to a different open proxy (and thus a different IP address) every few minutes. So my spamming activity isn’t tied to a specific IP address.

Hypothetically speaking, if the problem of open proxies were to disappear overnight, there are two other mechanisms that provide a limitless set of IP addresses to spammers: dialup and spoofing.

Most dialup ISPs provide a different IP address each time you dial in. If a spammer were to find that their IP address had been banned, they could simply disconnect and redial. It would be trivial to automate the process of dialing in, spamming, disconnecting, and dialing back in.

IP addresses are easy to fake as well. The design principles of TCP/IP allows the sender of a packet to specify its IP address. The message will still be routed to its destination using the fake origin address. Return packets would be mis-routed, however, because TCP/IP would send responses to the true location of the IP address rather than where it actually came from. This means that IP spoofing is ineffective in situations where you need to interact with a remote server, but very effective in a one-way conversation. I can’t retrieve a Web page using a spoofed IP address because I need to make the request and then have the server send me the page. But I can send requests all day long if I don’t care about the response.

Posting a comment (or TrackBack) doesn’t require interaction. I can send a comment in a POST or GET message and not worry about the response if I don’t care about receiving acknowledgment that it was successful.

Simply put, if a spammer wants to spam your site...they will figure out a way.
(2011-10-17, 12:00 PM)Vapor Wrote: [ -> ]Simply put, if a spammer wants to spam your site...they will figure out a way.

IP banning isn't just for spammers.
And to answer your question....you might be banning your country block by mistake?
(2011-10-17, 11:49 AM)dtommy79 Wrote: [ -> ]Hi,

Strange thing happening. Every time I try to ban someone by IP, the board bans me (the admin) as well.

Any idea? Using the latest version of MyBB.

Are you sure you're banning their IP, not yours?
Yes, I'm sure. And I'm banning the whole IP address not just an IP range
Are you using CloudFlare? If so, unless you mod ./inc/functions.php as described here, all IP's will be a CloudFlare IP.
(2011-10-17, 01:48 PM)Paul H. Wrote: [ -> ]Are you using CloudFlare?

No, I'm not.
(2011-10-17, 01:48 PM)Paul H. Wrote: [ -> ]Are you using CloudFlare? If so, unless you mod ./inc/functions.php as described here, all IP's will be a CloudFlare IP.

No need for that anyway. 1.6.4 has a built in setting for this.
Pages: 1 2