adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-10-31 01:32:02 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity

fail2ban incorrectly refusing connections #589

New Issue
Closed
opened 2026-10-05 04:31:37 +02:00 by adam · 21 comments
adam commented 2026-10-05 04:31:37 +02:00
Owner
Copy link
Copy source

Occasionally when I launch my IRC client, I will get a message about my connection being refused because I am connecting too fast. When this happens, I need to connect to znc from another machine and unload the fail2ban module so that I can connect from my main PC again.

I'm using HexChat on Windows 8.1 and znc 1.6.1. My server information is saved in my client and connecting to znc is automated, so I can't be sending the incorrect login information. I don't know how to replicate this issue, as it happens pretty infrequently.

Occasionally when I launch my IRC client, I will get a message about my connection being refused because I am connecting too fast. When this happens, I need to connect to znc from another machine and unload the fail2ban module so that I can connect from my main PC again. I'm using HexChat on Windows 8.1 and znc 1.6.1. My server information is saved in my client and connecting to znc is automated, so I can't be sending the incorrect login information. I don't know how to replicate this issue, as it happens pretty infrequently. <!-- github-sync-id:107370205 -->
adam closed this issue 2026-10-05 04:31:37 +02:00
adam commented 2026-10-05 04:31:38 +02:00
Author
Owner
Copy link
Copy source

What is the exact error message?

What is the exact error message? <!-- github-comment-id:141741567 -->
adam commented 2026-10-05 04:31:39 +02:00
Author
Owner
Copy link
Copy source

I didn't copy it but I'm pretty sure it was "Closing link [Please try again later - reconnecting too fast]".

I didn't copy it but I'm pretty sure it was "Closing link [Please try again later - reconnecting too fast]". <!-- github-comment-id:141741835 -->
adam commented 2026-10-05 04:31:40 +02:00
Author
Owner
Copy link
Copy source

Are you sure that you don't have any other client running with same external IP that could be failing with identifying?

Monitoring znc -D somehow could be helpful.

Are you sure that you don't have any other client running with same external IP that could be failing with identifying? Monitoring `znc -D` somehow could be helpful. - https://github.com/znc/znc/blob/master/CONTRIBUTING.md <!-- github-comment-id:141748183 -->
adam commented 2026-10-05 04:31:40 +02:00
Author
Owner
Copy link
Copy source

You could load the adminlog module. It logs failed logins. This wouldn't provide much information for debugging this, but it would at least confirm that there are failed logins.

You could load the adminlog module. It logs failed logins. This wouldn't provide much information for debugging this, but it would at least confirm that there are failed logins. <!-- github-comment-id:141930878 -->
adam commented 2026-10-05 04:31:41 +02:00
Author
Owner
Copy link
Copy source

Is znc.log not automatically saved in /var/log/? I didn't explicitly set the log file when I initially loaded the adminlog module a few days ago, but I just got the error to happen again so I logged in from another device that znc isn't rejecting and set it to log to znc.log. However, I still don't see znc.log anywhere. I'm on Fedora 22.

Also, the exact message in my IRC client is "Closing link [Please try again later - reconnecting too fast]" as I mentioned above.

Is znc.log not automatically saved in /var/log/? I didn't explicitly set the log file when I initially loaded the adminlog module a few days ago, but I just got the error to happen again so I logged in from another device that znc isn't rejecting and set it to log to znc.log. However, I still don't see znc.log anywhere. I'm on Fedora 22. Also, the exact message in my IRC client is "Closing link [Please try again later - reconnecting too fast]" as I mentioned above. <!-- github-comment-id:142569935 -->
adam commented 2026-10-05 04:31:42 +02:00
Author
Owner
Copy link
Copy source

@poorchop Check the actual ZNC configuration dir, possibly in /home/USER/.znc/ and it will be in a log file in there somewhere. ZNC doesn't log by default to /var/log.

@poorchop Check the actual ZNC configuration dir, possibly in `/home/USER/.znc/` and it will be in a log file in there somewhere. ZNC **doesn't** log by default to /var/log. <!-- github-comment-id:142570944 -->
adam commented 2026-10-05 04:31:42 +02:00
Author
Owner
Copy link
Copy source

Thanks. Here are the messages that I'm getting, nothing special:

[2015-09-23 06:32:43] [] failed to login from
[2015-09-23 06:32:46] [Poorchop] failed to login from
[2015-09-23 06:32:46] [Poorchop] failed to login from
[2015-09-23 06:32:46] [Poorchop] failed to login from
[2015-09-23 06:32:46] [Poorchop] failed to login from
[2015-09-23 06:32:46] [Poorchop] failed to login from
[2015-09-23 06:32:46] [Poorchop] failed to login from
[2015-09-23 06:32:47] [Poorchop] failed to login from
[2015-09-23 06:32:47] [Poorchop] failed to login from
[2015-09-23 06:32:47] [Poorchop] failed to login from
[2015-09-23 06:32:47] [Poorchop] failed to login from

Thanks. Here are the messages that I'm getting, nothing special: [2015-09-23 06:32:43] [] failed to login from <my IP address> [2015-09-23 06:32:46] [Poorchop] failed to login from <my IP address> [2015-09-23 06:32:46] [Poorchop] failed to login from <my IP address> [2015-09-23 06:32:46] [Poorchop] failed to login from <my IP address> [2015-09-23 06:32:46] [Poorchop] failed to login from <my IP address> [2015-09-23 06:32:46] [Poorchop] failed to login from <my IP address> [2015-09-23 06:32:46] [Poorchop] failed to login from <my IP address> [2015-09-23 06:32:47] [Poorchop] failed to login from <my IP address> [2015-09-23 06:32:47] [Poorchop] failed to login from <my IP address> [2015-09-23 06:32:47] [Poorchop] failed to login from <my IP address> [2015-09-23 06:32:47] [Poorchop] failed to login from <my IP address> <!-- github-comment-id:142571346 -->
adam commented 2026-10-05 04:31:43 +02:00
Author
Owner
Copy link
Copy source

Those logs do look like fail2ban isn't refusing connections incorrectly.

Those logs do look like fail2ban isn't refusing connections incorrectly. <!-- github-comment-id:142576926 -->
adam commented 2026-10-05 04:31:44 +02:00
Author
Owner
Copy link
Copy source

Unloading fail2ban is what allows me to connect from my main computer again. Unless the loading/unloading of fail2ban is tied in with some other networking component of znc, I don't know what else it could be.

Unloading fail2ban is what allows me to connect from my main computer again. Unless the loading/unloading of fail2ban is tied in with some other networking component of znc, I don't know what else it could be. <!-- github-comment-id:142580648 -->
adam commented 2026-10-05 04:31:44 +02:00
Author
Owner
Copy link
Copy source

Fail2ban blocks IP from logging in after it has failed logging for some times. You pasted adminlog showing that you failing logging in 10 times so fail2ban only did what it's supposed to do and this issue is invalid.

Fail2ban blocks IP from logging in after it has failed logging for some times. You pasted adminlog showing that you failing logging in 10 times so fail2ban only did what it's supposed to do and this issue is invalid. <!-- github-comment-id:142581802 -->
adam commented 2026-10-05 04:31:45 +02:00
Author
Owner
Copy link
Copy source

Maybe I'm not following. All of my information is saved in the IRC client itself. I launch HexChat and it automatically connects to znc. I do this multiple times every single day without any issues. I'm not manually typing in passwords, so there's no way that the client is sending the wrong login information, otherwise it wouldn't work those countless other times that I launch the client.

After unloading fail2ban and relaunching HexChat, I can log back in just fine. Then I can reload fail2ban and relaunch HexChat multiple times until I eventually run into this issue again.

Maybe it's not the module's fault, which would make the title invalid, but the issue remains. There is some kind of miscommunication going on between the client and the bouncer, and I never had this issue until very recently. I've been sitting on the same HexChat version for a while now, while I have only been updating znc, so nothing changed on the client side.

Maybe I'm not following. All of my information is saved in the IRC client itself. I launch HexChat and it automatically connects to znc. I do this multiple times every single day without any issues. I'm not manually typing in passwords, so there's no way that the client is sending the wrong login information, otherwise it wouldn't work those countless other times that I launch the client. After unloading fail2ban and relaunching HexChat, I can log back in just fine. Then I can reload fail2ban and relaunch HexChat multiple times until I eventually run into this issue again. Maybe it's not the module's fault, which would make the _title_ invalid, but the issue remains. There is some kind of miscommunication going on between the client and the bouncer, and I never had this issue until very recently. I've been sitting on the same HexChat version for a while now, while I have only been updating znc, so nothing changed on the client side. <!-- github-comment-id:142586826 -->
adam commented 2026-10-05 04:31:46 +02:00
Author
Owner
Copy link
Copy source

That's hardly ZNC's fault though.

The module is operating correctly. I have HexChat as well with fail2ban enabled. These issues aren't reproduced on my connections.

The issue is therefore invalid against ZNC...

Sent from my iPhone. Please excuse any typos, as they are likely to happen by accident.

On Sep 23, 2015, at 08:44, Poorchop notifications@github.com wrote:

Maybe I'm not following. All of my information is saved in the IRC client itself. I launch HexChat and it automatically connects to znc. I do this multiple times every single day without any issues. I'm not manually typing in passwords, so there's no way that the client is sending the wrong login information, otherwise it wouldn't work those countless other times that I launch the client.

After unloading fail2ban and relaunching HexChat, I can log back in just fine. Then I can reload fail2ban and relaunch HexChat multiple times until I eventually run into this issue again.

Maybe it's not the module's fault, which would make the title invalid, but the issue remains. There is some kind of miscommunication going on between the client and the bouncer, and I never had this issue until very recently. I've been sitting on the same HexChat version for a while now, while I have only been updating znc, so nothing changed on the client side.

—
Reply to this email directly or view it on GitHub.

That's hardly ZNC's fault though. The module is operating correctly. I have HexChat as well with fail2ban enabled. These issues aren't reproduced on my connections. The issue is therefore invalid against ZNC... _Sent from my iPhone. Please excuse any typos, as they are likely to happen by accident._ > On Sep 23, 2015, at 08:44, Poorchop notifications@github.com wrote: > > Maybe I'm not following. All of my information is saved in the IRC client itself. I launch HexChat and it automatically connects to znc. I do this multiple times every single day without any issues. I'm not manually typing in passwords, so there's no way that the client is sending the wrong login information, otherwise it wouldn't work those countless other times that I launch the client. > > After unloading fail2ban and relaunching HexChat, I can log back in just fine. Then I can reload fail2ban and relaunch HexChat multiple times until I eventually run into this issue again. > > Maybe it's not the module's fault, which would make the title invalid, but the issue remains. There is some kind of miscommunication going on between the client and the bouncer, and I never had this issue until very recently. I've been sitting on the same HexChat version for a while now, while I have only been updating znc, so nothing changed on the client side. > > — > Reply to this email directly or view it on GitHub. <!-- github-comment-id:142588889 -->
adam commented 2026-10-05 04:31:46 +02:00
Author
Owner
Copy link
Copy source

As your logs say something from your IP is failing with logging in to ZNC, there is no way ZNC can cause that.

If you think it's a bug, you should report it against @HexChat, but keep in mind that no one else with HexChat can reproduce it.

As your logs say something from your IP is failing with logging in to ZNC, there is no way ZNC can cause that. If you think it's a bug, you should report it against @HexChat, but keep in mind that no one else with HexChat can reproduce it. <!-- github-comment-id:142619128 -->
adam commented 2026-10-05 04:31:47 +02:00
Author
Owner
Copy link
Copy source

So I guess your best strategy would be to run znc in debug mode (znc -D) and save its output to a file. Then, after this issue happened, you will know exactly what was sent by which client (including the password that caused the failed login). Hopefully that should help finding the culpit.

So I guess your best strategy would be to run znc in debug mode (`znc -D`) and save its output to a file. Then, after this issue happened, you will know exactly what was sent by which client (including the password that caused the failed login). Hopefully that should help finding the culpit. <!-- github-comment-id:142652687 -->
adam commented 2026-10-05 04:31:47 +02:00
Author
Owner
Copy link
Copy source

I have to build from source and enable debugging in order to be able to launch znc in debug mode, right? My current installation is from the repo. I guess I could just get the source files for the build in the repo and then compile it myself.

I have to build from source and enable debugging in order to be able to launch znc in debug mode, right? My current installation is from the repo. I guess I could just get the source files for the build in the repo and then compile it myself. <!-- github-comment-id:142713174 -->
adam commented 2026-10-05 04:31:48 +02:00
Author
Owner
Copy link
Copy source

@Poorchop no you don't need to recompile. Just run ZNC with this command, and save its output to a file: znc -D

@Poorchop no you don't need to recompile. Just run ZNC with this command, and save its output to a file: `znc -D` <!-- github-comment-id:142714987 -->
adam commented 2026-10-05 04:31:49 +02:00
Author
Owner
Copy link
Copy source

Can I manually point it to my config file? Mine is located in /var/lib/znc/.znc/configs but znc is looking in the normal location of ~/.znc/configs and it's failing to start up as a result.

Can I manually point it to my config file? Mine is located in /var/lib/znc/.znc/configs but znc is looking in the normal location of ~/.znc/configs and it's failing to start up as a result. <!-- github-comment-id:142717424 -->
adam commented 2026-10-05 04:31:49 +02:00
Author
Owner
Copy link
Copy source

Yes, check znc --help

2015-09-23 21:21 GMT+01:00 Poorchop notifications@github.com:

Can I manually point it to my config file? Mine is located in
/var/lib/znc/.znc/configs but znc is looking in the normal location of
~/.znc/configs and it's failing to start up as a result.

—
Reply to this email directly or view it on GitHub
https://github.com/znc/znc/issues/1108#issuecomment-142717424.

Yes, check znc --help 2015-09-23 21:21 GMT+01:00 Poorchop notifications@github.com: > Can I manually point it to my config file? Mine is located in > /var/lib/znc/.znc/configs but znc is looking in the normal location of > ~/.znc/configs and it's failing to start up as a result. > > — > Reply to this email directly or view it on GitHub > https://github.com/znc/znc/issues/1108#issuecomment-142717424. <!-- github-comment-id:142720710 -->
adam commented 2026-10-05 04:31:50 +02:00
Author
Owner
Copy link
Copy source

I don't think there's anything interesting in the logs for anyone who might be able to help - here's a useless, somewhat abridged snippet:

[2015-10-02 23:25:12.228261] (my IP address) CLI -> ZNC [CAP REQ :userhost-in-names multi-prefix znc.in/server-time-iso]
[2015-10-02 23:25:12.228631] (my IP address) ZNC -> CLI [:irc.znc.in CAP nickname1 ACK :userhost-in-names multi-prefix znc.in/server-time-iso]
[2015-10-02 23:25:12.555933] (my IP address) CLI -> ZNC [CAP END]
[2015-10-02 23:25:12.560608] (my IP address) ZNC -> CLI [:irc.znc.in 464 nickname4 :Please try again later - reconnecting too fast]
[2015-10-02 23:25:12.561429] USR::??? == Disconnected()
[2015-10-02 23:25:12.818501] (my IP address) CLI -> ZNC [CAP END]
[2015-10-02 23:25:12.819371] (my IP address) ZNC -> CLI [:irc.znc.in 464 znc-username :Please try again later - reconnecting too fast]
[2015-10-02 23:25:12.820389] USR::??? == Disconnected()
[2015-10-02 23:25:12.836953] (my IP address) CLI -> ZNC [CAP END]
[2015-10-02 23:25:12.837954] (my IP address) ZNC -> CLI [:irc.znc.in 464 nickname3 :Please try again later - reconnecting too fast]
[2015-10-02 23:25:12.838767] USR::??? == Disconnected()
[2015-10-02 23:25:21.916757] _LISTENER == ConnectionFrom(my IP address, xxxxx) [Allowed]
[2015-10-02 23:25:21.917307] There are [0] clients from [my IP address]
[2015-10-02 23:25:22.587927] _LISTENER == ConnectionFrom(my IP address, xxxxx) [Allowed]
[2015-10-02 23:25:22.588450] There are [0] clients from [my IP address]
[2015-10-02 23:25:22.692059] _LISTENER == ConnectionFrom(my IP address, xxxxx) [Allowed]
[2015-10-02 23:25:22.692519] There are [1] clients from [my IP address]
[2015-10-02 23:25:22.786890] _LISTENER == ConnectionFrom(my IP address, xxxxx) [Allowed]
[2015-10-02 23:25:22.787353] There are [2] clients from [my IP address]
[2015-10-02 23:25:22.884944] _LISTENER == ConnectionFrom(my IP address, xxxxx) [Allowed]
[2015-10-02 23:25:22.885529] There are [3] clients from [my IP address]
[2015-10-02 23:25:23.170675] _LISTENER == ConnectionFrom(my IP address, xxxxx) [Allowed]
[2015-10-02 23:25:23.171159] There are [4] clients from [my IP address]
[2015-10-02 23:25:23.338218] _LISTENER == ConnectionFrom(my IP address, xxxxx) [Allowed]
[2015-10-02 23:25:23.338712] There are [5] clients from [my IP address]
[2015-10-02 23:25:23.488034] _LISTENER == ConnectionFrom(my IP address, xxxxx) [Allowed]
[2015-10-02 23:25:23.488517] There are [6] clients from [my IP address]
[2015-10-02 23:25:23.713016] _LISTENER == ConnectionFrom(my IP address, xxxxx) [Allowed]
[2015-10-02 23:25:23.713509] There are [3] clients from [my IP address]
[2015-10-02 23:25:23.884613] _LISTENER == ConnectionFrom(my IP address, xxxxx) [Allowed]
[2015-10-02 23:25:23.885488] There are [3] clients from [my IP address]

However, it definitely looks like the wrong password is being sent multiple times, which is triggering fail2ban as expected. My client is somehow using the same password for multiple networks, so I guess that issue isn't on znc's end. Of course no other HexChat users are having this issue, and I haven't changed anything on my end since I started having this problem, so it will forever be a mystery.

I don't think there's anything interesting in the logs for anyone who might be able to help - here's a useless, somewhat abridged snippet: ``` [2015-10-02 23:25:12.228261] (my IP address) CLI -> ZNC [CAP REQ :userhost-in-names multi-prefix znc.in/server-time-iso] [2015-10-02 23:25:12.228631] (my IP address) ZNC -> CLI [:irc.znc.in CAP nickname1 ACK :userhost-in-names multi-prefix znc.in/server-time-iso] [2015-10-02 23:25:12.555933] (my IP address) CLI -> ZNC [CAP END] [2015-10-02 23:25:12.560608] (my IP address) ZNC -> CLI [:irc.znc.in 464 nickname4 :Please try again later - reconnecting too fast] [2015-10-02 23:25:12.561429] USR::??? == Disconnected() [2015-10-02 23:25:12.818501] (my IP address) CLI -> ZNC [CAP END] [2015-10-02 23:25:12.819371] (my IP address) ZNC -> CLI [:irc.znc.in 464 znc-username :Please try again later - reconnecting too fast] [2015-10-02 23:25:12.820389] USR::??? == Disconnected() [2015-10-02 23:25:12.836953] (my IP address) CLI -> ZNC [CAP END] [2015-10-02 23:25:12.837954] (my IP address) ZNC -> CLI [:irc.znc.in 464 nickname3 :Please try again later - reconnecting too fast] [2015-10-02 23:25:12.838767] USR::??? == Disconnected() [2015-10-02 23:25:21.916757] _LISTENER == ConnectionFrom(my IP address, xxxxx) [Allowed] [2015-10-02 23:25:21.917307] There are [0] clients from [my IP address] [2015-10-02 23:25:22.587927] _LISTENER == ConnectionFrom(my IP address, xxxxx) [Allowed] [2015-10-02 23:25:22.588450] There are [0] clients from [my IP address] [2015-10-02 23:25:22.692059] _LISTENER == ConnectionFrom(my IP address, xxxxx) [Allowed] [2015-10-02 23:25:22.692519] There are [1] clients from [my IP address] [2015-10-02 23:25:22.786890] _LISTENER == ConnectionFrom(my IP address, xxxxx) [Allowed] [2015-10-02 23:25:22.787353] There are [2] clients from [my IP address] [2015-10-02 23:25:22.884944] _LISTENER == ConnectionFrom(my IP address, xxxxx) [Allowed] [2015-10-02 23:25:22.885529] There are [3] clients from [my IP address] [2015-10-02 23:25:23.170675] _LISTENER == ConnectionFrom(my IP address, xxxxx) [Allowed] [2015-10-02 23:25:23.171159] There are [4] clients from [my IP address] [2015-10-02 23:25:23.338218] _LISTENER == ConnectionFrom(my IP address, xxxxx) [Allowed] [2015-10-02 23:25:23.338712] There are [5] clients from [my IP address] [2015-10-02 23:25:23.488034] _LISTENER == ConnectionFrom(my IP address, xxxxx) [Allowed] [2015-10-02 23:25:23.488517] There are [6] clients from [my IP address] [2015-10-02 23:25:23.713016] _LISTENER == ConnectionFrom(my IP address, xxxxx) [Allowed] [2015-10-02 23:25:23.713509] There are [3] clients from [my IP address] [2015-10-02 23:25:23.884613] _LISTENER == ConnectionFrom(my IP address, xxxxx) [Allowed] [2015-10-02 23:25:23.885488] There are [3] clients from [my IP address] ``` However, it definitely looks like the wrong password is being sent multiple times, which is triggering fail2ban as expected. My client is somehow using the same password for multiple networks, so I guess that issue isn't on znc's end. Of course no other HexChat users are having this issue, and I haven't changed anything on my end since I started having this problem, so it will forever be a mystery. <!-- github-comment-id:145198394 -->
adam commented 2026-10-05 04:31:51 +02:00
Author
Owner
Copy link
Copy source

i had this issue just now, it was because i set my anonymous IP limit to 1.
dont know why im classed as anonymous but hey, it works now.
this caused a ERR_INVALID_HTTP_RESPONSE in chrome.

i had this issue just now, it was because i set my anonymous IP limit to 1. dont know why im classed as anonymous but hey, it works now. this caused a `ERR_INVALID_HTTP_RESPONSE` in chrome. <!-- github-comment-id:422356715 -->
adam commented 2026-10-05 04:31:51 +02:00
Author
Owner
Copy link
Copy source

When a connection is established, it is anonymous, since there was so far no way to send login information. Also, browsers tend to use multiple connections simultaneously for speed (if SPDY is not available).
What anon IP limit does: Right after accept()ing a new socket (before any data was transferred), it counts the number of anonymous connections (and I guess it counts them incorrectly, both counting too high and too low...). If the limit is hit, the new socket is immediately closed again.

When a connection is established, it is anonymous, since there was so far no way to send login information. Also, browsers tend to use multiple connections simultaneously for speed (if SPDY is not available). What anon IP limit does: Right after `accept()`ing a new socket (before any data was transferred), it counts the number of anonymous connections (and I guess it counts them incorrectly, both counting too high and too low...). If the limit is hit, the new socket is immediately closed again. <!-- github-comment-id:422363458 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#589