Reading Time: 9 minutes

In this article, you will learn how and why a VPS serveror dedicated server might block an Internet Protocol address (IP address) and how to resolve it.

When your company hosts a website or web app online, whether it's an individual dedicated server or a whole server cluster, you naturally expect to have uninterrupted access at all times. It is possible, though unlikely, that your IP address might become blocked by your server, preventing you from connecting to and using the service.

If that has happened to you, this quick summary will provide you with all the essential information needed to verify the status of your IP. Additionally, some of the most common reasons for being blocked will be covered, as well as a few suggestions on how to unblock and whitelist your IP as quickly as possible. Learn more about how to avoid having your IP blocked.

How does IP address blocking work?

IP-based blocking creates barriers in a network that block all traffic to or from a set of IP addresses. This approach to blocking content doesn’t directly block content but traffic to known IP addresses associated with some content or an application. IP-based blocking is also accomplished by software on users’ computers, typically for network security purposes.

IP address blacklisting

IP blacklisting is a method of filtering illegitimate or malicious IP addresses from accessing networks. A list called a blacklist is created of the IPs desired for blocking and may contain individual or a range of IP addresses. Cybersecurity personnel typically use blacklists with intrusion prevention systems (IPS), firewalls, and other traffic filtering tools to filter malicious traffic according to policies or by manually adding specific IP addresses.

How do I know if my IP address has a IP blocked condition?

To verify if you are blocked from accessing your server, attempt to log in to your web server. Take note of the connection error message, which should indicate the specific reason for the IP blocking. In case the error message is vague or unspecific, you can also ping your server for more information.

Blocked IP address investigation — ping a server on Windows

  1. Open a Command Prompt by pressing the Windows+R keys to open a Run box.
  2. Type cmd in the Run box and then press the Ctrl+Shift+Enter keys in unison, which will open a verification popup asking if you would like to allow the cmd application to make changes to your device.
  3. Click the Yes option to open the Administrator Command Prompt:
Why is your IP blocked? This is the image result for a Windows user seeing a User Account Control popup.


Next, type in the ping command followed by your server's IP address, and then press the Enter key:

Why is your IP blocked? This is the image result for a Windows user seeing a Windows PowerShell popup.


Blocked IP address investigation — ping a server on a Mac

  1. Open Spotlight and search for Terminal.
  2. Open a terminal window and ping the IP address for your server:
Last login: Mon Jun 12 13:33:15 on ttys003
You have mail.
me@my-MacBook-Pro ~ % ping -c3 146.75.44.81
PING 146.75.44.81 (146.75.44.81): 56 data bytes
64 bytes from 146.75.44.81: icmp_seq=0 ttl=55 time=26.465 ms
64 bytes from 146.75.44.81: icmp_seq=1 ttl=55 time=24.864 ms
64 bytes from 146.75.44.81: icmp_seq=2 ttl=55 time=22.743 ms
--- 146.75.44.81 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 22.743/24.691/26.465/1.524 ms

3. If you can ping your server's IP address from your IP address, that suggests your IP is not completely blocked, and that the issue connecting to your server might not be related to your IP address.

4. However, if you see something like the output shown below, your IP address might be in an IP blocked state:

Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2

Additionally, you can ping the server's IP address with an external monitoring tool to see whether it's accessible from other locations. You can also check the operational status of the Liquid Web services on our website

If your server is accessible to others, and the operational status is fine, you could try logging in using a VPN until your IP blocked status is lifted. You might wonder why the server blocked your IP in the first place, and there can be a few reasons for this issue. Some main reasons will be related to trying to log in using incorrect credentials, or possibly having your IP associated with spam or malware-like behavior.

Failed web login attempts

The most common scenario for getting an IP blocked by your server is trying to log in too many times too quickly or with incorrect credentials. Most servers have a time limit placed for the number of login attempts. So, if you find yourself mistyping the username and password several times, it would be better to reset your password rather than risk getting blocked.

Why is your IP blocked? This image is the cPanel Login Invalid popup.

The reason that IP blocking options exist, is to prevent access from unauthorized individuals. This service prevents more severe threats, such as hackers or other malicious individuals, from gaining access to your information. If the number of login attempts wasn’t restricted, someone could potentially orchestrate a brute force attack against the server. This type of attack illustrates how an attacker could try to connect to your login via a continuous trial and error of random username/password combinations. Since most modern web hosting providers have a brute force monitoring option in place, it could be triggered by your actions as well.

Note:
Using a password manager is now an accepted standard security practice that stores the credentials for many services you use. In the future, this will reliably eliminate the issue of getting your IP blocked by the server for this reason.
Why is your IP blocked This image is the Webmail Login popup.

Incorrectly configured mail client

Your web-based mail server has similar brute force protection in place, which turns on when it detects a specific large number of frequent, unsuccessful login attempts. The problem, however, could be in the IMAP or POP3 configurations of your email client.

Why is your IP blocked This image is the Failed Webmail Login popup.

Having an error in the stored login credentials or if using SMTP validation, for example, (which doesn’t prevent the software from trying to reach out to the server on the web), could result in the connection attempt being blocked as well.

Misconfigured FTP or SSH access

Your server not only screens the login attempts to cPanel and the mail server, but it also monitors FTP and SSH connections. There is generally more room for error when logging in through an FTP client since it requires a bit more information than your regular web login. At a minimum, besides your regular username and password, you need to specify the hostname or IP of your server, and the correct port (21 for FTP, and 22 for SFTP, unless an alternative port is being used):

Why is your IP blocked? This image is the FTP Connection Failed popup.


Note:
The “Connection attempt failed with ‘econnrefused — Connection refused by server'” error means that the connection could not be established at the IP/port combo requested. This kind of IP blocked error is usually because the connection is failing due to a wrong username/password.

The SSH access configuration is often the trickiest. If you are not sure whether you’re using the correct command in the CLI (Command Line Interface) or Terminal), you can contact Liquid Web support at your web hosting company for a walkthrough the current SSH setup:

[root@host ~]# ssh [email protected]
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:

Spam or malware protection

In the unlikely event that someone does gain unauthorized access to your server, their actions are still being monitored for any suspicious activity through a list of rules specified in the ModSecurity module:

Why is your IP blocked? This image is the ModSecurity Block popup.


As soon as any malware-related activity is detected or your mail server or is being flagged for sending too many email messages, your IP will automatically be added to a blacklist — with the IP blocked as a result:

Why is your IP blocked? This image is the blue ModSecurity popup.


Note:
Regardless of the reason for your IP blocked condition, the restriction is selective and applies only to the traffic that is sent from you. Other server users or website visitors will still have regular, unrestricted access.

Steps to unblock your IP address

The first step to resolve a blocked IP is to submit a support request to Liquid Web with the blocked IP address (which you can look up online). At Liquid Web, we respond to your phone and chat support requests in less than a minute, but if you need a quicker response, there are alternative options for fixing the IP blocked condition that you can try to gain access promptly. These include using your the web hosting management interface:

Why is your IP blocked? This image is the Manage Unblock popup.


Of course, you can also use the ConfigServer Security and Firewall (CSF) interface within the WebHost Manager (WHM):

Why is your IP blocked? This image is the CSF Quick Unblock popup.


As noted earlier, you can also try logging in with a different IP, whether that’s from a different physical location (for example, from home instead of from your office) or through a VPN client. Once connected, verify that your login credentials are correct. If they are not, you can always reset your password. If, for some reason, you are unable to gain access to the server or don't hear back from the Liquid Web support team right away, you can try to access the server using your regular IP after 15 to 30 minutes, since most IP blocks only temporarily prevent access.

Contact Liquid Web

Reach out to your hosting provider. If your hosting provider is Liquid Web, the necessary expertise to investigate the IP blocked status and provide specific guidance and solutions tailored to your situation are available. Liquid Web is proud to be the Most Helpful Humans in Hosting™ and are always happy to help.

Check for Malware

Run a scan for malware on your personal computer. If your computer has malware that is using your connection to attack your server, a protective IP block can be triggered.

Update Software

Ensure that the software on your local computer or device is up to date. Routine updates of your operating system, web browser, and security software can help prevent compatibility issues or vulnerabilities that may contribute to IP blocks.

Change Your IP Address

If the issue persists, and you need immediate access, consider requesting a change in your IP address from your hosting provider. They can guide you through the necessary steps to obtain a new IP.

Use a VPN

As a temporary measure, you can use a VPN client to access the server from a different IP address. This option can help bypass the current IP blocked scenario and allow you to verify your login credentials or make necessary changes.

Conclusion

Being blocked from accessing your server, while a definite inconvenience, provides a needed function as the benefits decidedly outweigh the drawbacks. You have now learned how to test, verify, and remedy a blocked IP address in the utilities found both within my.liquidweb.com and the CSF interface.

Should you have an issue like this crop up, and you are experiencing problems in delisting your IP, contact one of Liquid Web’s knowledgeable systems administrators to have this concern addressed right away! Liquid Web also offers a variety of other managed hosting services, such as VMware hosting and cloud dedicated hosting. Call us today!

Frequently asked questions

How long will my IP address be blocked?

How long a given IP address is blocked will correspond to the unique circumstances relating to the block. Most IP blocks are temporary and will last for only a few minutes. For repeated violations or high-risk situations, an IP block will remain in place until it is lifted.

How do I find my IP address?

You can find your IP address by using the Internet Web Hosting Toolkit from Liquid Web. Specifically, our IP Checker tool reveals your IP address as seen by Liquid Web servers.

How do I prevent my IP from being blocked again?

  • Add your IP to the allowlist. Having your IP address explicitly added to the allowlist for your server will allow your IP to connect, regardless of detected behavior.
  • Avoid incorrect login attempts. Your IP address will be blocked if too many failed login attempts are detected. Ensure you’re entering the correct credentials (hint: check your caps lock key) — and you’ll go far. If you’re having difficulties remembering, consider using a password manager.
  • Use a static IP address. If you have a dynamic IP address, you might inadvertently be assigned an IP address that was previously blocked because of an unrelated third party.
  • Maintain a good IP reputation. Related to the previous answer, a poor IP reputation can cause an IP to be added to an internet standards organization's block list. Not having malware, not sending bulk unsolicited emails, and not having a shared connection are all things that will help maintain a good IP reputation.

Original Publication Date

This article was originally published in October 2022. It has since been updated for accuracy and comprehensiveness.

Avatar for Michael Pruitt

About the Author: Michael Pruitt

Michael Pruitt is a Support Systems Administrator for Nexcess. He brings over a decade of experience to his current role. When not working, Michael can be found officiating roller derby bouts.

Latest Articles

Using a Cloudflare Argo Tunnel with load balancing

Read Article

Subdomain takeover — protect your website against it!

Read Article

Controlling PHP settings with a custom php.ini file

Read Article

Linux dos2unix command syntax — removing hidden Windows characters from files

Read Article

Change cPanel password from WebHost Manager (WHM)

Read Article