I was experiencing a pretty bad slowdown while trying to use the admin pages of a WordPress site recently. The load on the machine was quite low, so I began to suspect that it was trying to call out to external services (facebook, pinterest, etc) that might have been blocked by CSF (configserver firewall).<\/p>\n
I started playing around with Here’s the little pipeline I used to look up the hostnames of the requests that were blocked:<\/p>\n It could be formatted nicer, but at least it gave me what I wanted. After removing an erroneous firewall entry using I was experiencing a pretty bad slowdown while trying to use the admin pages of a WordPress site recently. The load on the machine was quite low, so I began to suspect that it was trying to call out to external services (facebook, pinterest, etc) that might have been blocked by CSF (configserver firewall). I […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[6],"tags":[34,41,16,17,24,26],"_links":{"self":[{"href":"https:\/\/www.devolve.local\/wp-json\/wp\/v2\/posts\/666"}],"collection":[{"href":"https:\/\/www.devolve.local\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devolve.local\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devolve.local\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devolve.local\/wp-json\/wp\/v2\/comments?post=666"}],"version-history":[{"count":1,"href":"https:\/\/www.devolve.local\/wp-json\/wp\/v2\/posts\/666\/revisions"}],"predecessor-version":[{"id":667,"href":"https:\/\/www.devolve.local\/wp-json\/wp\/v2\/posts\/666\/revisions\/667"}],"wp:attachment":[{"href":"https:\/\/www.devolve.local\/wp-json\/wp\/v2\/media?parent=666"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devolve.local\/wp-json\/wp\/v2\/categories?post=666"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devolve.local\/wp-json\/wp\/v2\/tags?post=666"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}tcpdump<\/code> and friends and then realized that the information I was looking for (blocked outgoing requests) was already being logged in \/var\/log\/kern.log on our Ubuntu system (same on Debian).<\/p>\n\r\ngrep -F 'TCP_OUT Blocked' \/var\/log\/kern.log | awk '{print $13}' | cut -c 5- | sort -u | while read ip; do echo \"$ip\"; nslookup $ip | grep name | expand -1; done<\/pre>\ncsf -dr IP[\/CIDR|NETMASK]<\/code>, all was snappy once again.<\/p>\n","protected":false},"excerpt":{"rendered":"