General help

In Site Admin -> Security -> IP Blocker there is an option for 'Allowed' will be processed first.

Is that checked?

The box for allowed IP addresses ranges then contains the IP's.

There is also a box for denied IP's and ranges.

Either way it says: 'Put every entry on one line.'

There are three different ways to enter IP addresses ... CIDR, range, or partial.

Which are you using?

And I'll say this again ... believe it's almost futile to use this tool.   For example, I have two connections in different cities on different networks (cable).   From time to time provider refreshes the IP addresses allocated to their customers.  On servers where am trying to restrict access to certain services not even the "Class B" will work *all* the time.   Example: can't use 70.128.   Could use 70.  In order to be accurate I'd have to find the entire range of IP addresses ... all the IP blocks ... the provider might be using.

Check:

http://docs.moodle.org/26/en/IP_blocker

"If there are entries present in the Blocked IP List, any hosts for which Moodle cannot determine the IP address will be blocked by default. For example, hosts that are behind a web proxy server which does not pass the HTTP headers containing the remote IP address information. In this case Moodle cannot determine the host's IP address with which to compare against the Blocked IP List, so the host is blocked by default. A suggested workaround may be to change the Logged IP address source (getremoteaddrconf setting within Site administration > Server > HTTP > Reverse Proxy) from the default to "REMOTE_ADDR" which will log the IP address of the proxy server instead of the host behind it."

The server guys/gals probably use command line tools ... do you have shell access to the site?

One could setup a 'poor man's monitor' ... a script that pings an IP address one time and also records results in a log file every 5 minutes or so.    Could also have that send EMail.  That is ONLY if the server is allowed to ping.   The ip address it pings ... yours.

'spirit of sharing', Ken

Sounds like one could use a free monitoring service.  Not at university ... although they could set one up and check access to the server from the uni's network perspective.   Those checks would be from the monitoring service prospective, so once setting it up, you have to allow the IP address you see in logs access to Moodle.    Think I'd create a 'monitor.txt' file and put it at document root of the server.  And then point the monitoring service to that specific file.  'monitor.txt' doesn't have to be a web page ... just has 'success' on the first line of the .txt file.  Since that file is outside of Moodle, only apache is involved in granting/dis-allowing access.   It those succeed all the time, then one could deduct that it might be related to what the Moodle code can do to check the IP address.

Here's one such free monitoring service: https://dashboard.monitor.us/en/sign-in

maybe others have better suggestions.

When your workstation at the uni can't access, can you do things like 'traceroutes', dns lookups, or pings?  Examples:

From command prompt (assuming you are using Windows):

C:\tracert 'fully_qualified_domain_name_of_moodle_server'

Mac from terminal:

traceroute 'fully_qualified_domain_name_of_moodle_server'

Ping:

ping -c 1 'fully_qualified_domain_name_of_moodle_server'

Dig (DNS check):

dig 'fully_qualified_domain_name_of_moodle_server'

There is a Chrome tool:

https://chrome.google.com/webstore/detail/network-tools/ncnnjohmbhjghjnejmblnagjgcgcpgfa?hl=en

There are also addons for FireFox:

https://addons.mozilla.org/en-us/firefox/collections/riverlethe/scott_net/

In the ISO model, network comes before application.   So if workstations being used cannot access the web server, Moodle (the application) has no information upon which to act (allow/deny) and thus it would appear to be Moodle (might not be).  The default, if Moodle cannot check, is to block.   So there is the 'reverse' to consider as well ... using IP blocker, Moodle has to be allowed whatever checks it does to determine if an IP is allowed or not.  Example: let's say the Moodle code tries to do a reverse lookup on the IP address ... that involves DNS ... if that fails, result blocked.  Let's say the reverse lookup is successful and the next test Moodle tries to use is a ping.  If the uni servers are not allowed to use ICMP echos (ie, pings), that fails ... result blocked.

To resolve the issue is not an easy undertaking *IF* it is a networking issue.  But think you have to resolve that issue first ... ie, make sure that networking is ALWAYS there before assuming it's Moodle. One has to run those test when it happens.   Might run those test (ping/traceroute/DNS lookups) when it is working ... *record those results' in a text file for later reference.   When those test are NOT working, then one has something to compare.

When I had a problem like this (once), I created a troubles.html page that just said 'Thanks' on it.  Asked those having problems to go to that url.   http://site/troubles.html   Then looked at apache server access logs ...

Log might look something like this:

70.123.xxx.xx - - [19/Apr/2014:10:59:56 -0500] "GET /plugins/system/jcemediabox/js/jcemediabox.js?version=114 HTTP/1.1" 304 - "http://someserver.net/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:28.0) Gecko/20100101 Firefox/28.0"

Lots of info there isn't there!

If you had a monitor.txt or a troubles.html page at your apache root that would should in that log and some useful information to use in resolving the issue.

'spirit of sharing', Ken

Did some experimenting with a site related to ip blocking ... the ip addresses for allow/deny are recorded in the mdl_config table.

select allowbeforeblock,allowedip,blockedip from mdl_config

So when an IP is entered in the form to block, it's entered into the 'blockedip' of mdl_config table.  That table is accessed even before one can browse the Moodle front page.

So when you cannot access,  do you get a time out in the browser, or do you get a notification:

'This site is currently unavailable'

If you get that notification, browser did reach the server, but the ip address used by the workstation matched an entry in mdl_config:blockedip.

If you don't get that notification then it could be networking.

Question: how are you entering the IP addresses in the blocked ip list box?
Pasting?   Is there a blank space after an ip listed?   Do you have 'periods' located correctly?
Is there a blank line at the bottom?

'spriit of sharing', Ken