Does Zen block access to certain websites?

I'm not a particularly knowledgeable user of computers and the internet, so this a request for advice and help.

I recently changed ISP from Plusnet to Zen, and I now have a Zen FritzBox router with "normal"/default configuration.

I basically use the internet for online browsing and email (no streaming, no gaming...) and it usually works well.

For the past few days I have been trying to access and login to a particular classic-car website which I have visited regularly and often over many years. But I am finding I cannot now do so. I get the "website loading" icon, and eventually a screen message saying "problem loading page" , saying the website is taking too long to respond, and has timed out. The message has the usual advice saying try later, site may be busy, check your browser, and firewall settings etc. I can access all other websites perfectly normally.

When this persisted after several days I tried various checks. These seem to suggest that the problem is with my ISP, Zen.

The website in question is "Pennocks Fiero Forum", www.fiero.nl. It's a site for classic car enthusasts who own Pontiac Fiero cars, so is not a dodgy gambling or porn site!

Just to summarise what I've done so far:
1) I cleared my Firefox browser cache aand cookies and tried again. No joy;
2) I tried a different browser (Edge) on the same computer. No joy - same time-out problem;
3) I tried on another computer in the same household (which also uses the Zen ISP router). Same problem, website wouldn't load;
4) I checked the "Is It Down Right Now" website. That reported that fiero.nl was up and running normally.
5) I unplugged the Zen router, waited, and rebooted it. Stll no access to that website
6) I searched for the website (using Google) on my Android phone. This is where it gets interesting. When my phone was connected, via WiFi, to the internet via the Zen router, the fiero.nl page wouldn't load and i couldn't get access..... However,
7) when I disconnected my phone from wifi and the Zen router and instead accessed the internet via the EE network - my mobile network for both calls and data - the fiero.nl website was immediately accessed and on my phone screen.

To me that seems pretty clear evidence that Zen is somehow blocking access to that website. I have checked the router settings: there are no filters or parental controls activated, all settings are on the standard defaults..

I've tried phoning Zen tech support, but after 30 minutes of music, I have given up.

Can anybody shed light on this - and perhaps confirm my provisional diagnosis that this is indeed a problem with Zen somehow blocking access to this particular website?

In reply to a post by br1anstorm:

To me that seems pretty clear evidence that Zen is somehow blocking access to that website.

No. It is pretty clear evidence that there is no route between Zen and that website. A quite different conclusion.

>sudo traceroute www.fiero.nl
[sudo] password for root:
traceroute to www.fiero.nl (217.148.167.147), 30 hops max, 60 byte packets
1 <snip> 0.479 ms 0.401 ms 0.540 ms
2 lns1-ixn.lon.veloxserv.net (195.191.219.12) 15.188 ms 15.148 ms 15.195 ms
3 100.69.165.42 (100.69.165.42) 15.309 ms 15.301 ms 15.219 ms
4 9-1-39.ear1.London1.Level3.net (212.187.138.237) 15.262 ms 15.217 ms 15.283 ms
5 * * *
6 * * *
7 cr0.nikhef.nl.fusixnetworks.net (37.139.139.4) 22.056 ms 22.333 ms 22.327 ms
8 fusix-cr01nh.wd6.net (37.139.137.223) 22.275 ms 22.556 ms 22.175 ms
9 hosted-by.wd6.net (217.148.190.7) 22.534 ms 22.567 ms 22.719 ms
10 hosted-by.wd6.net (217.148.190.13) 23.440 ms 23.440 ms 23.379 ms
11 www.fiero.nl (217.148.167.147) 22.672 ms 22.919 ms 23.141 ms

No problem accessing http://www.fiero.nl./ here via Andrews & Arnold.

Cheers!

In reply to a post by DFScale:

In reply to a post by br1anstorm:

To me that seems pretty clear evidence that Zen is somehow blocking access to that website.

No. It is pretty clear evidence that there is no route between Zen and that website. A quite different conclusion.

>sudo traceroute www.fiero.nl
[sudo] password for root:
traceroute to www.fiero.nl (217.148.167.147), 30 hops max, 60 byte packets
1 <snip> 0.479 ms 0.401 ms 0.540 ms
2 lns1-ixn.lon.veloxserv.net (195.191.219.12) 15.188 ms 15.148 ms 15.195 ms
3 100.69.165.42 (100.69.165.42) 15.309 ms 15.301 ms 15.219 ms
4 9-1-39.ear1.London1.Level3.net (212.187.138.237) 15.262 ms 15.217 ms 15.283 ms
5 * * *
6 * * *
7 cr0.nikhef.nl.fusixnetworks.net (37.139.139.4) 22.056 ms 22.333 ms 22.327 ms
8 fusix-cr01nh.wd6.net (37.139.137.223) 22.275 ms 22.556 ms 22.175 ms
9 hosted-by.wd6.net (217.148.190.7) 22.534 ms 22.567 ms 22.719 ms
10 hosted-by.wd6.net (217.148.190.13) 23.440 ms 23.440 ms 23.379 ms
11 www.fiero.nl (217.148.167.147) 22.672 ms 22.919 ms 23.141 ms

OMG... @DFScale, I fear you've lost me completely there. I vaguely grasp what "traceroute" might try to reveal - but I simply don't understand, and can't interpret, that sequence of entries on your list.

I'm puzzled and confused. How and why is it that "there is no route between Zen and that website"? I have never before heard of such a situation. Is it unique to Zen (and if so why?). Is there a rational explanation? Is this permanent? Does this mean that I will not be able to access that website at all unless/until I change ISP?

Open a complaint with Zen. They should be able to check and resolve in a day or two.

http://www.fiero.nl./

Works fine for me on Zen with a FritzBox.

Works fine - and very quick to load - from my Zen connection.

Works fine for me on Zen, but not using a FB.

In reply to a post by astanden:

http://www.fiero.nl./

Works fine for me on Zen with a FritzBox.

This makes the situation I have encountered even harder to understand.

I've taken @pheasant's advice and submitted a help request to Zen. Let's hope they can not only explain, but actually solve, the problem.

In reply to a post by br1anstorm:

@DFScale, I fear you've lost me completely there. I vaguely grasp what "traceroute" might try to reveal - but I simply don't understand, and can't interpret, that sequence of entries on your list.

I'm puzzled and confused. How and why is it that "there is no route between Zen and that website"? I have never before heard of such a situation. Is it unique to Zen (and if so why?). Is there a rational explanation? Is this permanent? Does this mean that I will not be able to access that website at all unless/until I change ISP?

The only interpretation you need is that there are many hops on the route to a website. So, while it might be understandable that you think Zen are blocking the site, there are more players than just Zen who could be doing this. And not necessarily deliberately.

Beyond this, if you can do a traceroute yourself [does windows or apple have an equivalent?], you can see whether you are getting out of Zen with the request. And if you put a complaint in, you can attach the traceroute to the complaint.

It means that you won't be able to reach that site until someone fixes the break in the route. It would be melodramatic to change ISP for this.

Thanks @dfscale.... That begins to shed a bit of light.

I understand that there are many "hops" between my computer, Zen's router and servers, and the [eventual] destination website. So I recognise that the blockage or disconnect could be anywhere along the route. But how can that blockage be identified and overcome?

I'm a Linux user (who still very occasionally uses Windows). I have now discovered that I can run traceroute in the terminal. But identifying the different points on the route is still a mystery.

Which one(s) are Zen's? How do I know whether I have got out of, or beyond, Zen's bit of the route? Are the asterisks in your example the points where the connection drops? And how are they then identified, and who "fixes the break"? How is it that the others who have posted, who use Zen, and have tried to connect to fiero.nl, have been able to do so? If they take a different route, why can't I? If the software can't make a connection, can it be programmed to look for, and take, another route?

I wasn't seriously planning to quit Zen because of this, so no melodrama. But I'm looking at this as layman and user, not an IT communications expert. The questions seem to me pretty straightforward. An explanation in plain language, and a solution, would be very welcome...

Have a look at this https://www.catchpoint.com/network-admin-guide/how-t... The asterisks are where the router in question does not respond to pings and that stage of the traceroute 'fails'. If you reach the destination, it has succeeded. Really, you don't need to get into it too much. If others can get to it, it could be all sorts of things including you using dns servers with a duff ip address for your target.

As for other routes, the influence you have is limited to using your phone as a hotspot. The rest of it, the internet sorts out for itself with various routing algorithms, but not always promptly.

In reply to a post by br1anstorm:

Which one(s) are Zen's? How do I know whether I have got out of, or beyond, Zen's bit of the route? Are the asterisks in your example the points where the connection drops? And how are they then identified, and who "fixes the break"? How is it that the others who have posted, who use Zen, and have tried to connect to fiero.nl, have been able to do so? If they take a different route, why can't I? If the software can't make a connection, can it be programmed to look for, and take, another route?

when connected via Zen, from a command line if you run:

arp www.fiero.nl

What does your system return?

If you get returned the same IP address as in the posts above with the tracert then your DNS is fine. You should then be able to ping that IP address and get continuous, uninterrupted responses.

If you don’t then you have a routing issue.

If you do, then the issue isn’t routing but likely something else is blocking or filtering the website. Given that other Zen folks can reach the website, this looks to be the problem.

Two separate lines of investigation now, and here's what they reveal so far.

First, the traceroute check. My Windows laptop doesn't recognise the command "arp". But I can run traceroute in the terminal on my Linux machine. This is what it shows:

traceroute to fiero.nl (217.148.167.147), 30 hops max, 60 byte packets
1 fritz.box (xxx.xxx.xxx.x) 0.609 ms 0.610 ms 0.582 ms
2 lo0-0.bng4.wh-man.zen.net.uk (51.148.77.131) 20.971 ms 20.897 ms 20.849 ms
3 lag-8.p2.wh-man.zen.net.uk (51.148.73.118) 25.003 ms lag-8.p1.wh-man.zen.net.uk (51.148.73.116) 25.805 ms lag-8.p2.wh-man.zen.net.uk (51.148.73.118) 24.896 ms
4 lag-3.p2.ixn-lon.zen.net.uk (51.148.73.228) 25.816 ms 26.039 ms be26.p1.thn-lon.zen.net.uk (51.148.244.49) 25.578 ms
5 * ldn-bb1-link.ip.twelve99.net (62.115.120.74) 25.898 ms 25.905 ms
6 * * adm-bb2-link.ip.twelve99.net (62.115.137.235) 30.622 ms
7 adm-b3-link.ip.twelve99.net (62.115.138.171) 29.959 ms adm-b3-link.ip.twelve99.net (62.115.136.229) 30.151 ms adm-b3-link.ip.twelve99.net (62.115.138.171) 29.357 ms
8 fusix-ic-319182.ip.twelve99-cust.net (62.115.151.185) 29.276 ms 29.994 ms 30.873 ms
9 cr0.eunets.nl.fusixnetworks.net (37.139.139.248) 30.910 ms 30.639 ms 30.640 ms
10 fusix-cr01tc2.wd6.net (37.139.137.225) 30.515 ms 31.125 ms 31.772 ms
11 hosted-by.wd6.net (217.148.190.21) 32.609 ms 30.880 ms 32.729 ms
12 hosted-by.wd6.net (217.148.190.19) 31.479 ms 32.425 ms 29.867 ms
13 hosted-by.wd6.net (217.148.190.14) 30.972 ms 29.318 ms 31.455 ms
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
24 * * *
25 * * *
26 * * *
27 * * *
28 * * *
29 * * *
30 * * *


I've edited out my own username and IP address in that copy of the terminal result. I deduce that wd6.net might be the host server for the fiero.nl website, and that it is not allowing me to have access.

I've also had a reply from Zen Tech support. They pass the buck (am I surprised?) . They say ".... we believe the website has blocked your IP..... I suggest trying to contact the website owner and getting them to check that your IP is blocked....".

Yeah, right. They expect me to solve the problem by contacting the website admin in the Netherlands! And yet, as I understand it, Zen (or its router) sets and assigns my IP: it's not something I normally have to decide or mess with. So if it is Zen's IP - or they are managing it - why isn't Zen investigating and sorting this?

Edited by br1anstorm (Tue 18-Feb-25 10:53:45)

Well, yes, it does look like your IP has been blocked. Are you on fixed or dynamic IP? Because if it is fixed, it looks like you have been targetted specifically. There's a forum related to that site on the same IP address. Just saying ...

The only good thing about CGNAT is it makes IP bans less effective and less defensible.

Well there's something wrong with your routing. Here's what I get on IDNet:

1 4 ms 2 ms 2 ms 192.168.1.1
2 10 ms 9 ms 10 ms telehouse-gw10.idnet.net [212.69.63.54]
3 9 ms 9 ms 9 ms telehouse-gw7.idnet.net [212.69.63.126]
4 10 ms 9 ms 9 ms telehouse-gw8.idnet.net [212.69.63.143]
5 45 ms 10 ms 12 ms 81.25.207.41
6 10 ms 10 ms 10 ms ae-10.r22.londen12.uk.bb.gin.ntt.net [129.250.5.156]
7 15 ms 14 ms 15 ms ae-3.r22.amstnl07.nl.bb.gin.ntt.net [129.250.5.2]
8 15 ms 15 ms 20 ms ae-0.a01.amstnl09.nl.bb.gin.ntt.net [129.250.2.253]
9 16 ms 16 ms 16 ms xe-1-5-0-3.a01.amstnl09.nl.ce.gin.ntt.net [128.241.10.105]
10 17 ms 17 ms 17 ms cr0.nikhef.nl.fusixnetworks.net [37.139.139.4]
11 16 ms 17 ms 16 ms fusix-cr01nh.wd6.net [37.139.137.223]
12 17 ms 17 ms 17 ms hosted-by.wd6.net [217.148.190.7]
13 17 ms 17 ms 16 ms hosted-by.wd6.net [217.148.190.13]
14 17 ms 17 ms 17 ms www.fiero.nl [217.148.167.147]

The latter part of which matches what DFScale posted. It does look somewhat like your IP address has been blocked. As for who should deal with it that's complicated but overall I'd concur with Zen Support that it's up to you to contact them and ask to be unblocked. Zen are providing you the service you pay for and it appears to be working correctly. It's not Zen's fault if a remote host has chosen to block one of their IP addresses.

And for future reference the Windows command is tracert. I doubt it will produce a different answer however.

I concur with you and DFScale that it does look like its been blocked at the destination and also agree that its the OP who should be contacting them (not Zen) to find out why.

As said above, very evident your public IP address is being black-listed, hence blocked. Contact them to get it unblocked. It may be because the IP address within a range you’ve been assigned by Zen has been used in the past for reasons, that have caused them to block it. Only they can unblock it.

Edited by Pheasant (Tue 18-Feb-25 11:27:41)

In reply to a post by DFScale:

Well, yes, it does look like your IP has been blocked. Are you on fixed or dynamic IP? Because if it is fixed, it looks like you have been targetted specifically. There's a forum related to that site on the same IP address. Just saying ...

The only good thing about CGNAT is it makes IP bans less effective and less defensible.

I don't know whether I'm on fixed or dynamic IP. Who decides and how? I have the impression that Zen assigns my IP address (it is shown in the router settings and it is always 192.168.xxx.xx). Does that mean it is fixed? If so, then Zen has fixed it. How can I change it? Trying to do so because of one site seems like sledgehammer to crack nut...

Incidentally I have no idea what CGNAT is or why it might be relevant...

Yes there is a forum on the fiero.nl site. So what? That's its main raison d'etre: it is a source of tech info on maintaining that particular vehicle.

Why would I (and not Zen?) have been targetted specifically, and why now? I have accessed the site for more than a decade without problems via my previous ISP (who presumably gave me a different IP?) and have not logged into the fiero.nl site and forum at all since my move to Zen. So why would I now be blocked by the fiero site?

To me that suggests it's not personal, but that the fiero.nl servers have "blacklisted" all or some of the IP address(es) used or assigned by Zen., for reasons that have nothing to do with me. And as a Zen client, since only a couple of weeks ago, I'm now suffering the consequences. Is that a reasonable analysis?

If it is, could I not ask Zen to assign a different IP address to me?

In reply to a post by Pheasant:

As said above, very evident your public IP address is being black-listed, hence blocked. Contact them to get it unblocked. It may be because the IP address within a range you’ve been assigned by Zen has been used in the past for reasons, that have caused them to block it. Only they can unblock it.

Ah.... we may be successfully focusing in on the problem. That comment, @pheasant, looks like the most credible explanation I've seen.

So even though it's an IP address from a range assigned by Zen, Zen won't take any action to sort it? Feels a bit like they have sold me faulty/damaged goods: an IP address that is tainted for reasons that have nothing to do with me.

On that logic, they should replace it with a product - an IP address - that works, rather than saying 'tough, it's your problem'.

I have however found a way to email the fiero.nl forum/website admins, so have sent a message asking them to unblock my IP address if they have indeed blocked it. I wonder if that will resolve the situation?

192.168.x.x is your own ‘internal’ IP address range. It’s the external address that is the cause of concern.

Type in whatsmyip in your browser to see it.

It doesn’t quite work like that 😅

It more of a reputational factor that some other party in the whole wilderness of the internet that deigns or decides your IP address (or more likely a large range of addresses) have at some time in the past been deemed to be part of shall we say conduct unbecoming…

There are several such reputations agencies (all private) on the internet that rate IP address ranges like this or indeed the individual site owner / operator may run their own blacklisting too.

It’s almost impossible for Zen to do anything as there’s possibly millions of different hosts out there.

Ah.... every day is a learning experience. I simply didn't realise there was an internal and an external IP address. I've been to that linked site and can see my external IP address (both IPv4 and IPv6 versions).

I'm still in the dark over static v dynamic IP addresses, but maybe that's a separate topic for another thread or another day.

It does seem to be a wilderness or jungle out there if you don't have a map, or stray off the path!

I see there are ways to check whether one's IP address is on any of those blacklists maintained by agencies. Mine doesn't seem to be. But I'll now have to wait and see what reply I get from the fiero.nl admins.

You can ask Zen if they can put you on a different address range for your public IP. That should resolve your issue.

It's clear that other folks with Zen connections are not having this issue. That's quite likely because they are on different (that are not barred / blocked by your custom car website) public IP address ranges.

Zen will have a few ranges available that they should be able to assign you.

Edited by Pheasant (Tue 18-Feb-25 12:50:38)

In reply to a post by br1anstorm:

I don't know whether I'm on fixed or dynamic IP. Who decides and how? I have the impression that Zen assigns my IP address (it is shown in the router settings and it is always 192.168.xxx.xx). Does that mean it is fixed? If so, then Zen has fixed it. How can I change it? Trying to do so because of one site seems like sledgehammer to crack nut...

Zen decide and it's part of your contract. They can give you

1. a fixed IP, which stays the same usually for the duration of your contract
2. a dynamic IP, which can change each time your router connects
3. a CGNAT address

all these above are translated to your internal 192.168.x.x address by your router. This is Network Address Translation - NAT.

In reply to a post by br1anstorm:

Yes there is a forum on the fiero.nl site. So what? That's its main raison d'etre: it is a source of tech info on maintaining that particular vehicle.

Why would I (and not Zen?) have been targetted specifically, and why now? I have accessed the site for more than a decade without problems via my previous ISP (who presumably gave me a different IP?) and have not logged into the fiero.nl site and forum at all since my move to Zen. So why would I now be blocked by the fiero site?

So what: People write bad stuff on forums, so forums ban those people. If you have not been on the site since you joined Zen, then a previous person on your IP address probably got banned. IP bans are largely stupid, because:

• IP banning a CGNAT address means banning hundreds of people on the ISPs public IP address, all but one of whom are innocent
• IP banning a dynamic address means banning other innocent people who might get the same address over the days weeks, months and years ahead
• IP banning a static address means banning the innocent people who get that address, when it goes to a new customer after the original offender changed ISP's

In reply to a post by br1anstorm:

To me that suggests it's not personal, but that the fiero.nl servers have "blacklisted" all or some of the IP address(es) used or assigned by Zen., for reasons that have nothing to do with me. And as a Zen client, since only a couple of weeks ago, I'm now suffering the consequences. Is that a reasonable analysis?

If it is, could I not ask Zen to assign a different IP address to me?

None of it is a judgement on you as a person, it is a judgement on your IP address. fiero have blacklisted just ONE, all or some of Zen's IP addresses. Your first port of call is with the site admins, either by email or on the forums [yes, I know, I am not being daft - get on the internet somewhere else] specifically the forum admins. If you are a user with a good reputation and you explain that this comes about because you are with a new ISP, you can hope for sympathy.

Getting a new IP address from Zen is very much the last resort.

Edited by DFScale (Tue 18-Feb-25 13:13:10)

It will be interesting to find out if its just one IP or a range of IP that has been blocked. Hopefully its something that happened many moons ago and they are willing to unblock it now. It does seem over the top blocking an IP instead of disabling their user account within the forum but it may have been a Denial Of Service (DoS) attack rather than a keyboard warrior

Edited by PCJM40 (Tue 18-Feb-25 13:32:32)

In reply to a post by DFScale:

Getting a new IP address from Zen is very much the last resort.

Doesn't seem like the OP is particularly fussed or needs/wants a certain public IP address, just something that works for their browsing etc.

So following the path of least resistance; if the admins at the car website won't engage or play ball to de-backlist then asking Zen to assign a different IP range shouldn't be too difficult. May actually be easier and faster to do.

In reply to a post by br1anstorm:

Ah.... every day is a learning experience. I simply didn't realise there was an internal and an external IP address. I've been to that linked site and can see my external IP address (both IPv4 and IPv6 versions).

It's not that. Internal IP addresses are those on your LAN (typically 192.xx or 10.xx) and known as private addresses. As a domestic consumer you will only have one public IP address. However ISPs buy those addresses in blocks (much as no-one ever buys just one egg). However because a lot of public IP addresses are dynamic some hosts get in the habit of blocking entire ranges on the grounds that you might power cycle your router and return with a different address.

But as regards whose responsible Zen are only responsible for getting your data packets from your router onto the wider internet. That they have managed to do according to your routing. The fact that when they arrived the host refused to accept them is not Zen's fault.

It's a bit like you taking a taxi to a nightclub then being turned away by the bouncer. Would you complain to the taxi company? Now in this case there might be some mileage to Zen getting involved if it was a major host like the BBC because they won't want vast numbers of their customers being banned from there. But in this case it's a small site likely to be of interest to only a small number of its customers. There's just no reason for them to want to get involved.

Edited by Andrue (Tue 18-Feb-25 13:42:37)

If you turn off your router for a while (maybe 30-60 mins) then you may find that, if you are on dynamic, that you will pick up a different IP address (you can check the same way as you have just checked your external address). If it changes then you may find it changes to one that isn't blocked. If it doesn't change then you may be on a static IP in which case you might be able to get Zen to change you to a different static IP.

To muddy it a bit there is such a thing as "sticky dynamic" - this means your address comes from a pool of addresses but that they would generally assign you the same address from that pool even after a disconnection.

This obscure and minor problem - of me getting access to a single classic-car forum site - is providing me with a window into what seems a complex world of how-internet-connections-work. So thanks, first of all, to everyone who has posted. For me it is a real learning experience.

I'll try to respond to various of the points that have been made in the most recent half-dozen posts.

1) I don't know how Zen assigns IP addresses, what their range of addresses might be, and whether mine is static or dynamic. As @pheasant rightly observes, I just need a connection and an IP address that works for browsing etc. I'm not fussed or wedded to a specific set of numbers;

2) I did try powering off my Zen Fritzbox router soon after the problem first emerged. But just for 5 minutes or so, not an hour. So I don't know whether - as @ian72 - comments - this might result in a change to the IP address, either to something totally different , or to a "sticky" one that is in the same range, or indeed the same IP address as before... Is it worth powering down for a much longer period to see what if any difference that might make?

3) I like @andrue's analogy of a taxi (Zen) taking me to a nightclub (fiero.nl) whose bouncer then turns me away. Helps me to understand why Zen isn't bothered and won't do anything.

4) pretty much everyone seems to agree that either the specific IP address, or a range used by Zen, has been blacklisted somewhere along the transmission chain. My earlier post giving the result of my 'traceroute' command shows that the connection stops, or is timed out, at the 11th to 13th "hops", by a server at wd6.net, We can all make guesses as to why (eg dodgy behaviour by a previous user of the IP address..). For what it's worth this classic-car technical forum is hardly the sort of site that might generate bad behaviour by those who visit, and not the sort of forum where admins have to ban people for inappropriate comments or conduct!)

5) I have reached out to the fiero.nl website admin.... and got a reply, confirming that he/they have not blocked, banned or blacklisted my IP address. I have sent him a copy of the traceroute result which shows where the connection is blocked or timed out, and now wait to see what further insight or explanation they can provide.

So the investigation continues.....

Edited by br1anstorm (Tue 18-Feb-25 20:00:20)

2) I did try powering off my Zen Fritzbox router soon after the problem first emerged. But just for 5 minutes or so, not an hour. So I don't know whether - as @ian72 - comments - this migh result in a change to the IP address, either to something totally different , or to a "stcky" one that is in the same range, or indeed the same IP address as before... Is it worth powering down for a much longer period to see what if any difference that might make?

30 minutes should do it. If you can live with it off overnight. Switch it off after you go to bed and light it up in the morning

3) I like @andrue's analogy of a taxi (Zen) taking me to a nightclub (fiero.nl) whose bouncer then turns me away. Helps me to understand why Zen isn't bothered and won't do anything.

It's a good analogy by @andrue. The bouncer at the club doesn't like the colour of the car you've turned up in. If you turn up in another coloured car he should let you in. 😂

5) I have reached out to the fiero.nl website admin.... and got a reply, confirming that he/they have not blocked, banned or blacklisted my IP address. I have sent him a copy of the traceroute result which shows where the connection is blocked or timed out, and now wait to see what further insight or explanation they can provide.

In that case, I really think you'll need to ask Zen to assign you from a different / fresh IP range, away from what you have. Try the router power down first through as per @ian72 suggestion. Otherwise, Zen have plenty of IP ranges to choose from...😅

51.148.0.0/16
51.155.0.0/16
62.3.64.0/18
77.104.128.0/18
82.68.0.0/15
82.71.0.0/16
88.97.0.0/18
88.97.64.0/19
88.97.96.0/20
88.98.0.0/20
88.98.16.0/23
88.98.18.0/24
88.98.21.0/24
88.98.22.0/23
88.98.24.0/21
88.98.32.0/19
88.98.64.0/19
88.98.128.0/19
88.98.160.0/21
88.98.170.0/23
88.98.172.0/22
88.98.176.0/20
91.235.214.0/24
146.66.64.0/18
185.81.232.0/22
188.122.32.0/20
188.122.60.0/23
185.6.135.0/24
185.169.116.0/23
185.169.118.0/23
185.183.100.0/22
188.122.48.0/21
188.122.56.0/22
188.122.63.0/24
193.19.156.0/23
212.23.0.0/19
217.155.0.0/16

2a02:8010::/29

Thanks @pheasant, that sounds like a plan. I'll try the overnight router switch-off and then see what happens when I try to reconnect tomorrow.

Interesting that Zen has such a selection of IP addresses to choose from. Their Tech Support people didn't offer the option of a change to a different address or range (another colour of taxi!) when I raised the issue with them.

Make a note of your external/public/WAN address tonight before you drop the router power. Make a note of again in the morning. Just so you can track the change, aids in diagnosis. I suspect you don’t have a fixed IP address.

The question really is how “sticky” it is. I don’t really know how sticky Zen’s addresses are.

I have an EE FTTP connection and that is sticky through router reboots, but anything longer and it will jump to a completely different range.

The list of IP subnets (ranges) above that Zen hold is purely illustrative. It doesn’t necessarily mean that they will be handing all of those out. They may be reserved for other purposes etc. But it gives you some idea of the scope of what could be assigned.

As another line of attack, is there a good enough mobile signal at your location that you could use your mobile phone as a hot spot and connect your computer to that? If you can do that and reach the site it points to your Zen identity being blocked. If you are still blocked it points to something in your system that is causing the problem. Have you run any sort of malware scan to make sure your machine hasn't been hijacked and is being used for nefarious purposes?

In reply to a post by astanden:

http://www.fiero.nl./

Works fine for me on Zen with a FritzBox.

In reply to a post by Woolwich:

Works fine - and very quick to load - from my Zen connection.

In reply to a post by Scottish_Pete:

Works fine for me on Zen, but not using a FB.

Whilst we wait for the OP to return after overnight router power down...

Can I ask each of you what public subnet / IP range you folks are assigned by Zen (don't reveal your entire public IP though - the first 3 octets are enough)?

Edited by Pheasant (Wed 19-Feb-25 09:28:45)

In reply to a post by Pheasant:

Can I ask each of you what public subnet / IP range you folks are assigned by Zen

I'm on 82.68.xxx.xx. On the other hand, just to stick another spanner in, maybe I was connecting over IPv6...

I can reach the site on Zen (static) IP range 217.155.*.*

If the OP is on Zen via CityFibre then I'm pretty sure it's a static IP. I don't know how it works via Openreach.

Edited by timo_w2s (Wed 19-Feb-25 12:02:54)

In reply to a post by Woolwich:

In reply to a post by Pheasant:

Can I ask each of you what public subnet / IP range you folks are assigned by Zen

I'm on 82.68.xxx.xx. On the other hand, just to stick another spanner in, maybe I was connecting over IPv6...

There is a handy extension for firefox, chromium, chrome and maybe others, called ipvfoo, which displays a little 4 or 6 in or near the url bar to indicate which IPv is in use. Until I installed ipvfoo, I too had no idea whether I was using IPv6, since there was absolutely no discernable difference once I got IPv6 connectivity.

In reply to a post by timo_w2s:

if the OP is on Zen via CityFibre then I'm pretty sure it's a static IP. I don't know how it works via Openreach.

Always been fixed IP on Zen for Openreach. I've had mine for 10 or 15 years.

Here's the latest update from me as the OP.

In case it's relevant, I should say that I'm on Zen FTTC and OpenReach (full fibre to my premises isn't - yet - available, so no CityFibre or alternative network.

First, the overnight power-off of my Zen router. As identified by the whatsmyipaddress website, the external IP address I had was (IPv6) 2a02:8012:e66b:xxxx:xxxx:xxxx:xxxx:xxxx, and/or (IPv4) 77.104.xxx.xxx.

This morning I switched the router back on, and the IP address was the same as before. I don't know whether that means Zen sets a static IP address for each customer, or whether this is a "sticky" dynamic one that happens not to have changed. I might ask Zen....in case I ever need to ask them to change it.


It is interesting that those other Zen customers who have replied to @pheasant's question, and who have been able to access the fiero.nl site without difficulty, are on IP addresses from Zen's other ranges.

I have also had a further response, and indeed a solution to the original problem, from the fiero.nl website admin (who I might say has been very helpful throughout). The message I got from him this morning is self explanatory:
"I think I found the culprit. It wasn't that your specific IP address was blocked, but an entire range of IP addresses where yours falls under. Someone with an IP address within that range tried suspicious things on my server and was automatically blocked by the server. I've removed that block so you should be able to reach the forum again."

And sure enough, I can now once again access the fiero.nl website and forum easily and immediately.

All of which goes to confirm the rather scathing comment in an earlier post by @DFScale that

"IP bans are largely stupid, because:

IP banning a CGNAT address means banning hundreds of people on the ISPs public IP address, all but one of whom are innocent
IP banning a dynamic address means banning other innocent people who might get the same address over the days weeks, months and years ahead
IP banning a static address means banning the innocent people who get that address, when it goes to a new customer after the original offender changed ISP".

Clearly I had difficulty in accessing that specific website because someone else on a different IP address from the same Zen range did something inappropriate which triggered a ban on the entire range of IP addresses.

I'm pleased and relieved that the problem is sorted; and in the process I have learned a lot. I just hope it never happens to me again.

Meanwhile, sincere thanks to all who have joined in the discussion and helped to clarify what was initially for me a baffling and unwelcome problem.

Seems their server took a bit of a sledgehammer to fix the "problem". By blocking a range of addresses they blocked users that were not part of the mis-deed. For a small site it may be a reasonable risk as the chances of others connecting from the same range are probably quite low - you were unlucky to be one of them.

Glad you got it sorted and seems the solution was what was expected very early days. Zen couldn't have done anything to resolve the issue and if they had to contact every 3rd party provider that might have blocked an IP of theirs then they wouldn't get anything else done - I can't think of many providers that would have done this for you although some of them might have given you more pointers to getting it resolved - in reality though Zen gave you the right advice).

As far as your IP whether it is very sticky or static results in pretty much the same - if you always get the same IP then it is essentially static no matter how they deliver it. At least now you know and I suspect you now know quite a bit more about IP networks than you probably ever wanted to

Glad you got it sorted

Thanks for coming back, br1anstorm. It's a good result and thanks for letting us know.

Yes, my comment was rather scathing and I would concede that some forms of activity can only be dealt with by IP blocks - for example Denial of Service [DoS] attacks. Often the owner of the machine can be unaware of the attacks because their machine has been taken over as part of a botnet

Even in these cases, I think that any IP ban should be time limited, [a month? 3 or 6 months?] because bad actors tend never to stay in one place for long, often because their ISP tells them to move on, or the botnetted customer cleans up their machine. The permanent IP ban then leaves others to suffer the consequences deep into the future.

In reply to a post by br1anstorm:

It is interesting that those other Zen customers who have replied to @pheasant's question, and who have been able to access the fiero.nl site without difficulty, are on IP addresses from Zen's other ranges.

I have also had a further response, and indeed a solution to the original problem, from the fiero.nl website admin (who I might say has been very helpful throughout). The message I got from him this morning is self explanatory:
"I think I found the culprit. It wasn't that your specific IP address was blocked, but an entire range of IP addresses where yours falls under. Someone with an IP address within that range tried suspicious things on my server and was automatically blocked by the server. I've removed that block so you should be able to reach the forum again."

And sure enough, I can now once again access the fiero.nl website and forum easily and immediately.

Great. 👍

Sounds like the server auto blocked the 77.104.128.0/18 range your IP address was part of. Hence why folks on some other Zen ranges were able to connect.

As said, glad they came to the party and removed the block.

Thanks for circling back too.

In reply to a post by ian72:

Seems their server took a bit of a sledgehammer to fix the "problem". By blocking a range of addresses they blocked users that were not part of the mis-deed. For a small site it may be a reasonable risk as the chances of others connecting from the same range are probably quite low - you were unlucky to be one of them.

Perhaps but the logic is justifiable.

A couple of FreePBX / Asterisk boxes I’ve run over the years employ fail2ban which effectively does this. It works on a small scale deployment against bots and brute force attacks. Not always ideal, but it’s sometime better to have something which provides protection and limits complete server meltdowns and inconveniences the few for the benefit of most legitimate users.

I see from the wikipedia entry that Fail2ban generally does a time limited ban, with the initial levels being just a few minutes.

I think the default period was 24 hours, but don’t take my word for it. It’s been a while 😂

Hello again....

Just when I thought it was safe to go back online, it turns out that my announcement on Wed 19 Feb (see my last post above) that the problem had been resolved was a little premature!

As explained, the website owner/admin investigated why I was having problems accessing the site. He found that the website servers had identified the range of IP addresses which included mine as being "suspect", so had blocked them all automatically.

He was able to remove the block. So I thought all was well, and in fact was able to access and log in to the forum at www.fiero.nl again as normal.

It didn't last. 48 hours later, I found that - once again - I couldn't reach the site. So I contacted the website owner/admin again. And this was his reply, received today:
"It was the same problem; your ip address (or to be more precise, an entire range where your ip address is a part of) was automatically blocked again by my server. I removed the block so all should be well again but I suspect it will happen again because I found out *why* it's blocking the ip addresses: because the (external) location database thinks the ip address is from Bulgaria (which is a country that is blocked access to my server). I'm trying to get this fixed since this is obviously an error in the database, but I have no idea how long this will take. In the mean time, just let me know whenever you are blocked again and I will unblock the ip range.

This is clearly unsatisfactory and isn't a permanent fix.

We know - thanks to @pheasant's earlier posts and the replies from others - that Zen manages or assigns IP addresses from numerous different ranges. Mine is 77.104.xxx.xxx. Those Zen clients on other IP addresses have had no problems. But this particular range (or some addresses within it) , managed by Zen, a UK ISP, is apparently identified as being based in Bulgaria!

I have no idea how or why this is the case. But it is giving me (and indeed the fiero.nl site owner) continuing problems.

I am therefore aiming to contact Zen tech support to report all this and to request them to assign me a new IP address from a new and "clean" range that is correctly identified and listed as being managed by Zen in UK and not linked with dodgy actors in Bulgaria.

I hope they will agree.....

I have no idea how or why this is the case. But it is giving me (and indeed the fiero.nl site owner) continuing problems.

As there is a scarcity of IPv4 addresses, ISPs and other organisations regularly buy and sell block of addresses that they can then allocate for their own use / customers. These can previously come from anywhere in the world, they can be traded an infinite number of times in theory.

Unfortunately the past “baggage” and “geographic location” of these IP ranges can live on in various geo-location and other reputational databases, which aren’t always either kept up to date or completely accurate.

I am therefore aiming to contact Zen tech support to report all this and to request them to assign me a new IP address from a new and "clean" range that is correctly identified and listed as being managed by Zen in UK and not linked with dodgy actors in Bulgaria.

I hope they will agree.....

Definitely worth a shot. They should be able to assign you from a fresh subnet.

Oh, frustrating. Like I said, IP blocking, at least on anything beyond a time limited basis is stupid. And the fact is that IP blocks are traded and likely to be traded faster and more furiously over the next few years until people realise that it's time to bite the bullet and go for IPv6. This all makes geoip blocking unreliable to the point of stupidity.

In reply to a post by Pheasant:

Definitely worth a shot. They should be able to assign you from a fresh subnet.

Well to say I am unhappy with my ISP is an understatement.

I sent a detailed email to Zen describing the problems I had encountered. I passed on the information from the fiero.nl website admin indicating that my IP address-range had been identified and blocked as originating from Bulgaria, and that the website owner was seeking to have the IP database corrected or updated. I noted that Zen managed various IP address ranges and asked them meanwhile to assign me a new, different "clean" one.

This is the response I have just received from their tech support team:
"....I'm sorry to hear about the IP issues, sadly we do not change our static IP's I'd suggest using a VPN to access the website if you didn't want to ask the owner but this is his issue."

I don't know what others think, but I find this totally unacceptable. Once again (and I have already seen this pattern from Zen) they are ducking the issue, declining to help, and passing the buck. I will be responding to that Zen message in fairly forthright terms. But I'd be interested in any comments.

Confused by Zen's response as you have communicated with the admins of the blocked forum who did remove the IP range block but it has been reinstated because of continued dodgy activity from other Zen IP's in the range you're in.

The least Zen could do now is change your IP address as you have gone as far as you can with the forum admin. May be you need to contact that guy who runs Zen, I can't remember his name but someone may have his email address.

In reply to a post by br1anstorm:

I don't know what others think, but I find this totally unacceptable. Once again (and I have already seen this pattern from Zen) they are ducking the issue, declining to help, and passing the buck. I will be responding to that Zen message in fairly forthright terms. But I'd be interested in any comments.

Escalation required.

Richard Tang, CEO
https://www.ceoemail.com/s.php?id=ceo-10544&c=Zen%20...

Sadly this is a typical Zen response. The support has declined rapidly over the last few years.

I'm on 88.97.16.xxx with Zen.
It's a fixed IP, and that used to be one of Zen's USPs, although I don't know if it applies to new subscribers.

In reply to a post by br1anstorm:

We know - thanks to @pheasant's earlier posts and the replies from others - that Zen manages or assigns IP addresses from numerous different ranges. Mine is 77.104.xxx.xxx. Those Zen clients on other IP addresses have had no problems. But this particular range (or some addresses within it) , managed by Zen, a UK ISP, is apparently identified as being based in Bulgaria!

Hum, a Dutch website, cannot legally ban connections from Bulgaria. That is a serious contravention of the single market as both countries are members of the EU. Bit tricky complaining about it now, thanks to Brexit, though.

In reply to a post by jabuzzard:

Hum, a Dutch website, cannot legally ban connections from Bulgaria. That is a serious contravention of the single market as both countries are members of the EU. Bit tricky complaining about it now, thanks to Brexit, though.

That's a somewhat pedantic point. There would perhaps be a case to answer if the connection was indeed from Bulgaria. The [Bulgarian] user might feel he could sue the Dutch website.

The point however is that that isn't the case here. So the comment about whether a ban would contravene EU rules is purely theoretical and academic

The Zen IP address range in question (77.104.xxx.xxx) is operating from and controlled by Zen in the UK. I don't know exactly how registrations or IP address 'owners' are recorded on global databases. But the explanation I have seen is that these records, whatever they are, are inaccurate or have not been kept up to date as the "ownership" of these ranges or blocks of IP addresses has been bought, sold or transferred.

So some servers think the IP address assigned to me by Zen is located in or managed from, Bulgaria. It isn't.

It seems a bit like buying a used car and then getting demands to pay parking fines incurred by the previous owners. The provider/seller of the car has an obligation to ensure what the Americans call "clean title" to the goods they offer.

Edited by br1anstorm (Mon 24-Feb-25 23:50:30)

I'm inclined to side with with Zen on this one though maybe the news could have been delivered with more customer-service friendly language. It's not reasonable to expect an ISP to do work because a server admin self-hosting a forum in the Netherlands has an inaccurate geo IP database. They are routing your packets to that host, the host is then dropping them. Every database I can query easily shows that IP space as being Zen's and based in the UK.

This isn't someone DDoSing the server from Zen IP space and Zen letting it happen, the permanent fix is for that server admin to not use an inaccurate geo IP database.

In reply to a post by jpm:

This isn't someone DDoSing the server from Zen IP space and Zen letting it happen, the permanent fix is for that server admin to not use an inaccurate geo IP database.

I agree. The server owner is not so much protecting his servers - he is actually disconnecting his users.

In reply to a post by jpm:

I'm inclined to side with with Zen on this one though maybe the news could have been delivered with more customer-service friendly language. It's not reasonable to expect an ISP to do work because a server admin self-hosting a forum in the Netherlands has an inaccurate geo IP database. They are routing your packets to that host, the host is then dropping them. Every database I can query easily shows that IP space as being Zen's and based in the UK.

This isn't someone DDoSing the server from Zen IP space and Zen letting it happen, the permanent fix is for that server admin to not use an inaccurate geo IP database.

As someone said earlier... the online world can be a jungle sometimes.

To be fair to the website-admin in the Netherlands, he does realise that his server is basing its auto-block on an inaccurate geo-IP database. And he has said he'll do what he can to sort this out. But he has warned it could well take some time. I have no idea which database is at fault, how these databases are run and managed, and why bad or out-of-date listings aren't being corrected.

But it's interesting that I got an instant reply - late in the evening - from Richard Tang, the Zen CEO to whom I'd sent a message. I had already been in contact with him previously some weeks ago about the initial inability of Zen to connect and deliver my broadband and VOIP services, and he intervened to get that sorted.

Richard clearly takes his responsibility and reputation seriously: he gets things done, This is what he said: "Very sorry ... I thought we’d fixed the Bulgarian IP address issue (we bought a couple of IPv4 blocks from Bulgaria)… but it looks like we haven’t completely fixed it. I’ll get our Networks team onto it.".

To me, it is hugely impressive, but also embarrassing, that the Zen CEO sends such a reply.

Impressive that he took the trouble to reply personally and very quickly. Shows that Zen knew about the Bulgarian problem, saw it as their responsibility, and had taken action to sort it. Just not quite enough.

The embarrassment is that Zen's tech support people appeared not to be aware of any of this, and worse, that they sent a reply saying in effect "....we refuse to do anything, go away, sort it yourself".

If I were the Zen CEO I'd be asking some hard questions about the calibre, competence and quality of their support staff. It is a nonsense that a message to the CEO is needed to get a practical solution.

Hopefully this turns into a pincer movement on the providers of the geo-ip database.

Will this be the last instalment in the story?

I have just had a call from Zen. They have now taken some action - presumably triggered by the CEO's intervention. Their complaints team (the same staff member who dealt with my previous issue last month over the initial setting-up of my broadband and phone connection) phoned and emailed me to confirm that the matter had been resolved.

They have assigned me a new static IP address - from their range 146.66.xxx.xxx. It appears to be working fine: no "Bulgarian problem".

Zen are also re-checking whatever inaccurate IP database was the cause of the problem . That - along with the efforts being made by the website owner in the Netherlands whose servers were affected - ought to sort out the geo-IP inaccuracy.

So once again and for the second time in as many months, Zen have come good in the end. But it's been hard work. Many thanks to all in this forum who have contributed comments and advice.

In reply to a post by br1anstorm:

I have just had a call from Zen. They have now taken some action - presumably triggered by the CEO's intervention.

Glad you stuck with it and got the IP address changed, shame you had to escalate it to their CEO to get something done. All the best.

Got there. Well done for persevering with it 👍

Raises other questions to me.

What are Zen - a company that have boasted in the past about having an excess of IPV4 addresses thanks to being one of the UK's oldest ISPs - doing recycling Bulgarian IPs they've bought to paying customers without having cleared up database issues? Stinks.

My own disappointing interactions with Zen support over obviously poor performance on their own network vs the Openreach one on the same FTTP line terminating at the same equipment at the exchange led me to dump them, and I'm not sure I'd ever take another Zen service again.

Zen have been selling blocks of IP's recently, so it might be a case that they're not swimming in spare IP's as they once were.