I monitor various locations connectivity and services with UptimeRobot.
Last week they changed their monitoring infrastructure as announced six months ago which results in new IP addresses monitoring your services.
Since I never bothered whitelisting the old ones, I didn’t bother changing anything on my side in preparation for their changes.
But when the change got live last week, I suddenly got hundreds of alerts per day for flapping services form all sites, except one. and also calls from customers asking what was going on with those alerts every five to ten minutes.
I needed a while to realize that the alerts where only coming from the Turris Omnia sites, since there where so many to go trough.
But even then, I was looking at many things, but not the dynamic firewall. Only after I disabled the dynamic firewall, that the alerts suddenly stopped and everything went back to normal.
After that I did a cross-reference of the new UptimeRobot IP-list with the latest Turris greylist CSV and it did contain some matches.
Interestingly, the one site who was unaffected, had the newer “Experimental client for Dynamic Firewall” installed, while the other ones still had the old one. I can’t say if that is good or bad for the new client 