Remote Access - Repeatable Authentication Issue - Detailed Logs Showing Issue Provided

Plex Media Server Remote Access
1

ISSUE: Plex maybe using systems in China to validate PMS systems. When USG firewalls – GeoBlocking China causes client to go to relay mode rather than remote. I have not confirmed that Plex is using systems with IP addresses in China (or the IPs being used were are known to be China IPs). However, there will be a follow up when a PMS is built on a network I can log better. – For now if you are blocking inbound connections from China or using a USG and are experiencing issues with remote users going into relay mode you will need to remove the block to address the issue.

[Details]

After a large and very time consuming amount of testing on various applications. This issue is repeatable, details of the process will be posted after this post, following an additional post of logs, and then old notes following this issue.

Here is the following possible conclusions for this specific issue.

The issue when using UniFi Security Gateway – When using GEO blocking and selecting China this will break Plex and cause some users to relay… The issue only comes up when inbound connections are blocked. Outbound (PMS network side) connections being blocked does not cause the issue for relay. (NOTE: This implies that Plex is generating a inbound connection to a PMS for validation, if you block that address your users could be forced into relay mode)

This issue could be caused by an IP range that Ubiquiti is pre-assigning for the Block that isnt China, or that Plex is using a server in China to validate a PMS. End users of the device cannot define the GEO block list for a given country… This only occurs when blocking China, additional country blocks are just fine.-- Because I dont have a syslog server for the USG I was not able to determine the inbound IP(s) that was causing the issue. I will need to setup a Plex server on the Palo Alto (for which I do have syslog server for) and see what inbound IP is needed to be whitelisted (follow up to this thread when that is determine… or perhaps Plex would like to tell us IPs we should be whitelisting,… i wont hold my breath on that). I would say it would be nice to have such a list, but given how fluid cloud networks are…might have to be a large range.

[Equipment/Software/Networks Used]
This was tested via the plex.tv web UI on a windows workstation inside a Palo Alto firewall. I shutdown all services on a windows workstation (yes I know) that might clutter the logs leaving only one browser open and one tab. Testing was done on both Chrome and Firefox.

External Connections using the web UI were tested throughout the US on similar workstations.
Seattle, Chicago, LA, NYC, KC, Atlanta, St. Louis, Tampa, Dallas, Houston, among others. No international networks were tested.Networks varied but results were the same.

External Connections were tested on Android and Iphones. Current software revisions for Android: :8.1.0 - Unknown on Iphone checked it at the time it was current… Verizon & AT&T networks.

Model UniFi Security Gateway 3P
Version: 4.4.51.5287926

PMS: Is configured to manually allow traffic through ports 32400. During testing the ports were monitors remotely to ensure there was connectivity externally through the firewall and to the PMS itself. I’ve seen prior posts by Plex moderators saying you cant monitor the port, that is untrue you can. The port responds to specific code but you do not need to know the code to know if the port is open. A port that is being blocked will drop connection. A port that is open will at a bare min yield a prompt (waiting your command). A simple telnet your IP 32400 in a command window will yield a black screen with a flashing cursor… e.g an open port. … a close port will get you a timeout or just a disconnect.

2

Details of Testing:

The following details out the network traffic that occurs when opening a browser, launching the url www.plex.tv and logging into an account. From there clicking the Launch button to start the plex UI. I attempt to start a video. When blocking the message prompt comes up telling the user they are relaying. This is also validated on the PMS by looking at the user details to see if they are labeled as remote or relay. – After validating the browser is closed, this is the entire process and generally take only a min.

{Experience when not blocking China}

Launch Chrome browser: www.plex.tv and sign in
Makes 1 connect to Fastly Server 151.101.50.217
Makes 3 connects to attempted to the internal IP of the PMS
Makes 1 connects to 50.31.142.95 chi.outbrain.com
Makes 3 connects to attempted to the internal IP of the PMS
Makes 1 connects to Plex Amazon Ireland Servers
Makes 1 connects to US pubsub110.pop.ewr.plex.bz
Makes 1 connects to external network port @ home on port 32400
Makes 1 connects to 50.31.142.95 chi.outbrain.com
Makes 1 Connects to Fastly Servers 151.101.49.140 (paloalto identifies this with reddit)
Makes 4 Connects to external IP of my network on port 32400 (expected traffic)
Makes 2 Connects to Facebook
Makes 6 Connects to external IP of my network on port 32400
Makes 7 Connects to Plex Amazon Ireland Servers
Makes 3 Connects to Google (expected)
Makes 1 Connects to pubsub10.pop.ewr.plex.bz
Makes 7 Connects to Google
Makes 1 Connects to 192.0.73.2 - redirects https://en.gravatar.com/ tracking site

{Experience when blocking China} – Relaying is overly complex and appears prone to failure

Launched Firefox browser (avoiding any caching)
Hit Fastly the web host for plex.tv - 151.101.48.201
Makes 1 connect to Plex Amazon Ireland Servers
Makes 1 connect to Plex Amazon US Server
Makes 1 connect to StackPath Server
Makes 3 connect to cloudflare Server
Makes 1 connect to external port of my network on port 32400
Makes 2 connect to attempted to the internal IP of the PMS
Makes 1 connect to Plex Amazon Ireland Servers
Makes 1 connect to external network port @ home on port 32400
Makes 1 connect to Cloudfront 54.239.180.35
Makes 1 connect to CloudFlare 104.18.21.226
Makes 1 connect to Verizon Business Class IP 72.21.91.29 (unkown that this IS is for)
Makes 2 connect to external port of my network on port 32400
Makes 1 connect to Plex Amazon Ireland Server
Makes 2 connect to internal PMS IP address (why it does this unknown, it made a connect to the external IP already)
Makes 2 connect to Plex Amazon Ireland Server
Makes 1 connect to Canada pubsub00.pop.yyz.plex.bz
Makes 1 connect to internal PMS IP address on port 32400
Makes 2 connect to external IP address on port 32400
Makes 1 connect to internal PMS IP address on port 32400
Makes 3 connect to relay05.pop.atl.plex.bz
Makes 1 connect to Plex Amazon Ireland Servers
Makes 1 connect to Fastly Servers 151.101.49.132
Makes 1 connect to 192.0.72.2 (curious DNS name. see below for IP whois) - https://en.gravatar.com/ tracking site
Makes 3 connect to Plex Amazon Ireland Servers
Makes 1 connect to relay05.pop.atl.plex.bz
Makes 1 connect to GitHub server - 185.199.111.153
Makes 2 connect to Two different CloudFlare Servers
Makes 1 connect to Canada pubsub00.pop.atl.plex.bz
Makes 1 connect to Fastly Servers 151.101.48.217 (PaloAlto indicates this is vimeo-base)
Makes 1 connect to Verizon Business Class IP 72.21.91.29 (unkown that this IS is for)
Makes 1 connect to Sprint based site 198.70.69.50 - Reason Uknown
Makes 1 connect to Fastly Server 151.101.48.201
Makes 2 connect to Plex Amazon Ireland Servers
Makes 1 connect to CloudFront Server US 54.230.75.217
Makes 1 connect to relay05.pop.atl.bz
Makes 1 connect to Sprint based site 198.70.69.50 - (palo notes this as browsing, could be video feed relay)
Makes 1 connect to Fastly Servers 151.101.48.201
Makes 2 connect to Plex Amazon Ireland Servers
Makes 1 connect to CloudFront US 54.230.75.217
Makes 1 connect to relay05.pop.atl.plex.bz
Makes 1 connect to Sprint based site 198.70.69.50 - (palo notes this as browsing, could be video feed relay)
Makes 1 connect to Guidewire Ireland Server 185.99.108.153
Makes 1 connect to i0.wp.com 192.0.73.2 - redirects https://en.gravatar.com/ tracking site
Makes 1 connect to relay05.pop.atl.plex.bz
Makes 1 connect to Fastly Servers 151.101.48.217
Makes 1 connect to Verizon Business Class IP 72.21.91.29 (unkown that this IS is for)
Makes 2 connect to Plex Amazon Ireland Servers
Makes 1 connect to GitHub 185.199.108.153
Makes 1 connect to 192.0.73.2 - redirects https://en.gravatar.com/ tracking site

IP Lookup Information When NOT Blocking China On the USG

Source: whois.arin.netIP Address: 151.101.49.140Name: SKYCA-3Handle: NET-151-101-0-0-1Registration Date: 2/1/16Range: 151.101.0.0-151.101.255.255Org: FastlyOrg

Handle: SKYCA-3Address: PO Box 78266
City: San FranciscoState/Province: CAPostal Code: 94107

Source: whois.arin.netIP Address: 192.0.73.2Name: AUTOMATTICHandle: NET-192-0-64-0-1Registration Date: 11/20/12Range: 192.0.64.0-192.0.127.255Org: Automattic,

IncOrg Handle: AUTOM-93Address: 60 29th Street #343
City: San FranciscoState/Province: CAPostal Code: 94110Country: United States

Source: whois.arin.netIP Address: 108.177.122.157Name: GOOGLEHandle: NET-108-177-0-0-1Registration Date: 3/7/12Range: 108.177.0.0-108.177.127.255Org: Google

LLCOrg Handle: GOGLAddress: 1600 Amphitheatre Parkway
City: Mountain ViewState/Province: CAPostal Code: 94043Country: United States

Source: whois.arin.netIP Address: 151.101.50.217Name: SKYCA-3Handle: NET-151-101-0-0-1Registration Date: 2/1/16Range: 151.101.0.0-151.101.255.255Org: FastlyOrg

Handle: SKYCA-3Address:PO Box 78266 San Francisco CA 94107 City: State/Province: CAPostal Code: 94107Country: United States

Source: whois.arin.netIP Address: 50.31.142.95Name: SCN-3Handle: NET-50-31-128-0-1Registration Date: 2/3/11Range: 50.31.128.0-50.31.255.255Org: Server Central

NetworkOrg Handle: SCN-18Address: 111 W. Jackson Blvd. Suite 1600 City: ChicagoState/Province: ILPostal Code: 60604Country: United

Source: whois.arin.netIP Address: 172.104.211.98Name: LINODE-USHandle: NET-172-104-0-0-1Registration Date: 6/19/15Range: 172.104.0.0-172.105.255.255Org:

LinodeOrg Handle: LINODAddress: 249 Arch St City: PhiladelphiaState/Province: PAPostal Code: 19106Country: United States

IP Lookup Information When BLOCKING China On the USG

Source: whois.arin.netIP Address: 151.101.48.201Name: SKYCA-3Handle: NET-151-101-0-0-1Registration Date: 2/1/16Range: 151.101.0.0-151.101.255.255Org: FastlyOrg

Handle: SKYCA-3Address: PO Box 78266
City: San FranciscoState/Province: CAPostal Code: 94107Country: United States

Source: whois.arin.netIP Address: 104.18.156.41Name: CLOUDFLARENETHandle: NET-104-16-0-0-1Registration Date: 3/28/14Range: 104.16.0.0-104.31.255.255Org:

Cloudflare, Inc.Org Handle: CLOUD14Address: 101 Townsend Street
City: San FranciscoState/Province: CAPostal Code: 94107Country: United States

Source: whois.arin.netIP Address: 151.139.128.14Name: SL-892Handle: NET-151-139-0-0-1Registration Date: 7/5/16Range: 151.139.0.0-151.139.255.255Org: StackPath,

LLC.Org Handle: SL-892Address: 2021 McKinney Avenue Suite 1100
City: DallasState/Province: TXPostal Code: 75201Country: United States

Source: whois.arin.netIP Address: 104.18.21.226Name: CLOUDFLARENETHandle: NET-104-16-0-0-1Registration Date: 3/28/14Range: 104.16.0.0-104.31.255.255Org:

Cloudflare, Inc.Org Handle: CLOUD14Address: 101 Townsend Street
City: San FranciscoState/Province: CAPostal Code: 94107Country: United States

Source: whois.arin.netIP Address: 72.21.91.29Name: EDGECAST-NETBLK-01Handle: NET-72-21-80-0-1Registration Date: 4/23/07Range: 72.21.80.0-72.21.95.255Org: MCI

Communications Services, Inc. d/b/a Verizon BusinessOrg Handle: MCICSAddress: 22001 Loudoun County Pkwy
City: AshburnState/Province: VAPostal Code: 20147Country: United States

Source: whois.arin.netIP Address: 192.0.77.2Name: AUTOMATTICHandle: NET-192-0-64-0-1Registration Date: 11/20/12Range: 192.0.64.0-192.0.127.255Org: Automattic,

IncOrg Handle: AUTOM-93Address: 60 29th Street #343
City: San FranciscoState/Province: CAPostal Code: 94110Country: United States

Source: whois.arin.netIP Address: 104.17.67.195Name: CLOUDFLARENETHandle: NET-104-16-0-0-1Registration Date: 3/28/14Range: 104.16.0.0-104.31.255.255Org:

Cloudflare, Inc.Org Handle: CLOUD14Address: 101 Townsend Street
City: San FranciscoState/Province: CAPostal Code: 94107Country: United States

Source: whois.arin.netIP Address: 104.18.157.41Name: CLOUDFLARENETHandle: NET-104-16-0-0-1Registration Date: 3/28/14Range: 104.16.0.0-104.31.255.255Org:

Cloudflare, Inc.Org Handle: CLOUD14Address: 101 Townsend Street
City: San FranciscoState/Province: CAPostal Code: 94107Country: United States

Source: whois.arin.netIP Address: 151.101.48.217Name: SKYCA-3Handle: NET-151-101-0-0-1Registration Date: 2/1/16Range: 151.101.0.0-151.101.255.255Org: FastlyOrg

Handle: SKYCA-3Address: PO Box 78266
City: San FranciscoState/Province: CAPostal Code: 94107Country: United States

Source: whois.arin.netIP Address: 72.21.91.29Name: EDGECAST-NETBLK-01Handle: NET-72-21-80-0-1Registration Date: 4/23/07Range: 72.21.80.0-72.21.95.255Org: MCI

Communications Services, Inc. d/b/a Verizon BusinessOrg Handle: MCICSAddress: 22001 Loudoun County Pkwy
City: AshburnState/Province: VAPostal Code: 20147Country: United States

Source: whois.arin.netIP Address: 198.70.69.50Name: NETBLK-SPRINTBLKHandle: NET-198-67-0-0-1Registration Date: 2/11/93Range: 198.67.0.0-198.70.255.255Org:

SprintOrg Handle: SPRNAddress: 12502 Sunrise Valley Drive
City: RestonState/Province: VAPostal Code: 20196Country: United States

185.99.108.153 inetnum:185.99.108.0 - 185.99.108.255 netname: GWRE-DUB country: IE 1001 E Hillsdale Blvd, Foster City CA 94404, USA

3

NOT GEOBLOCKING ON USG - LOGS FROM EXTERNAL CONNECTING TO PMS

Receive Time	Time Logged	Source address	Destination address	Destination Country	NAT Source IP	NAT Destination IP	Application	Source Port	Destination Port	NAT Source Port	NAT Destination Port	IP Protocol	Bytes	Bytes Sent	Bytes Received	Packets	Elapsed Time (sec)	Packets Sent	Packets Received	Session End Reason
6/3/2020 8:47	6/3/2020 8:47	MY WORKSTATION IP	151.101.50.217	United States	MY EXTERNAL NETWORK IP	151.101.50.217	ssl	20668	443	39603	443	tcp	11867	2667	9200	53	610	25	28	tcp-fin
6/3/2020 8:47	6/3/2020 8:47	MY WORKSTATION IP	PLEX PMS Internal IP 	Non-Routeable Address	MY EXTERNAL NETWORK IP	PLEX PMS Internal IP 	incomplete	20846	32400	33128	32400	tcp	352	132	220	4	3	2	2	aged-out
6/3/2020 8:47	6/3/2020 8:47	MY WORKSTATION IP	PLEX PMS Internal IP 	Non-Routeable Address	MY EXTERNAL NETWORK IP	PLEX PMS Internal IP 	incomplete	20850	32400	61687	32400	tcp	352	132	220	4	3	2	2	aged-out
6/3/2020 8:47	6/3/2020 8:47	MY WORKSTATION IP	50.31.142.95	United States	MY EXTERNAL NETWORK IP	50.31.142.95	ssl	20833	443	32218	443	tcp	6456	2117	4339	16	0	8	8	tcp-fin
6/3/2020 8:47	6/3/2020 8:47	MY WORKSTATION IP	PLEX PMS Internal IP 	Non-Routeable Address	MY EXTERNAL NETWORK IP	PLEX PMS Internal IP 	incomplete	20854	32400	59170	32400	tcp	352	132	220	4	3	2	2	aged-out
6/3/2020 8:47	6/3/2020 8:47	MY WORKSTATION IP	PLEX PMS Internal IP 	Non-Routeable Address	MY EXTERNAL NETWORK IP	PLEX PMS Internal IP 	incomplete	20846	32400	52648	32400	tcp	176	66	110	2	0	1	1	aged-out
6/3/2020 8:48	6/3/2020 8:48	MY WORKSTATION IP	PLEX PMS Internal IP 	Non-Routeable Address	MY EXTERNAL NETWORK IP	PLEX PMS Internal IP 	incomplete	20850	32400	47336	32400	tcp	176	66	110	2	0	1	1	aged-out
6/3/2020 8:48	6/3/2020 8:48	MY WORKSTATION IP	PLEX PMS Internal IP 	Non-Routeable Address	MY EXTERNAL NETWORK IP	PLEX PMS Internal IP 	incomplete	20854	32400	8579	32400	tcp	176	66	110	2	0	1	1	aged-out
6/3/2020 8:48	6/3/2020 8:48	MY WORKSTATION IP	172.104.211.98	United States	MY EXTERNAL NETWORK IP	172.104.211.98	ssl	20845	443	18967	443	tcp	7274	2198	5076	23	3	10	13	tcp-fin
6/3/2020 8:48	6/3/2020 8:48	MY WORKSTATION IP	99.81.213.165	Ireland	MY EXTERNAL NETWORK IP	99.81.213.165	ssl	20831	443	51693	443	tcp	13836	5019	8817	39	7	18	21	tcp-rst-from-client
6/3/2020 8:48	6/3/2020 8:48	MY WORKSTATION IP	151.101.49.140	United States	MY EXTERNAL NETWORK IP	151.101.49.140	reddit-base	20678	443	42083	443	tcp	10281	4284	5997	52	610	26	26	tcp-fin
6/3/2020 8:48	6/3/2020 8:48	MY WORKSTATION IP	50.31.142.95	United States	MY EXTERNAL NETWORK IP	50.31.142.95	ssl	20832	443	65457	443	tcp	6634	2238	4396	20	8	11	9	tcp-rst-from-client
6/3/2020 8:48	6/3/2020 8:48	MY WORKSTATION IP	PLEX PMS External IP	United States	MY EXTERNAL NETWORK IP	PLEX PMS External IP	ssl	20840	32400	34860	32400	tcp	7293	1937	5356	23	4	12	11	tcp-fin
6/3/2020 8:48	6/3/2020 8:48	MY WORKSTATION IP	PLEX PMS External IP	United States	MY EXTERNAL NETWORK IP	PLEX PMS External IP	ssl	20848	32400	56848	32400	tcp	19751	3429	16322	34	36	17	17	tcp-rst-from-client
6/3/2020 8:48	6/3/2020 8:48	MY WORKSTATION IP	PLEX PMS External IP	United States	MY EXTERNAL NETWORK IP	PLEX PMS External IP	ssl	20847	32400	59997	32400	tcp	38426	6114	32312	58	36	26	32	tcp-rst-from-client
6/3/2020 8:48	6/3/2020 8:48	MY WORKSTATION IP	PLEX PMS External IP	United States	MY EXTERNAL NETWORK IP	PLEX PMS External IP	ssl	20839	32400	37497	32400	tcp	13716	4239	9477	31	38	16	15	tcp-rst-from-client
6/3/2020 8:48	6/3/2020 8:48	MY WORKSTATION IP	PLEX PMS External IP	United States	MY EXTERNAL NETWORK IP	PLEX PMS External IP	ssl	20849	32400	34543	32400	tcp	29772	3567	26205	46	36	21	25	tcp-rst-from-client
6/3/2020 8:49	6/3/2020 8:49	MY WORKSTATION IP	157.240.19.26	United States	MY EXTERNAL NETWORK IP	157.240.19.26	facebook-base	20829	443	49618	443	tcp	181568	6075	175493	220	65	84	136	tcp-fin
6/3/2020 8:49	6/3/2020 8:49	MY WORKSTATION IP	157.240.19.35	United States	MY EXTERNAL NETWORK IP	157.240.19.35	facebook-base	20835	443	38697	443	tcp	12018	7487	4531	43	67	21	22	tcp-fin
6/3/2020 8:49	6/3/2020 8:49	MY WORKSTATION IP	PLEX PMS External IP	United States	MY EXTERNAL NETWORK IP	PLEX PMS External IP	ssl	20858	32400	10025	32400	tcp	25523	3177	22346	42	32	19	23	tcp-rst-from-client
6/3/2020 8:49	6/3/2020 8:49	MY WORKSTATION IP	PLEX PMS External IP	United States	MY EXTERNAL NETWORK IP	PLEX PMS External IP	ssl	20860	32400	22240	32400	tcp	13930	2939	10991	28	32	15	13	tcp-rst-from-client
6/3/2020 8:49	6/3/2020 8:49	MY WORKSTATION IP	PLEX PMS External IP	United States	MY EXTERNAL NETWORK IP	PLEX PMS External IP	ssl	20863	32400	49224	32400	tcp	15099	2076	13023	28	32	14	14	tcp-rst-from-client
6/3/2020 8:49	6/3/2020 8:49	MY WORKSTATION IP	PLEX PMS External IP	United States	MY EXTERNAL NETWORK IP	PLEX PMS External IP	ssl	20862	32400	16583	32400	tcp	17217	2135	15082	30	32	15	15	tcp-rst-from-client
6/3/2020 8:49	6/3/2020 8:49	MY WORKSTATION IP	PLEX PMS External IP	United States	MY EXTERNAL NETWORK IP	PLEX PMS External IP	ssl	20861	32400	21933	32400	tcp	16026	2136	13890	29	32	15	14	tcp-rst-from-client
6/3/2020 8:49	6/3/2020 8:49	MY WORKSTATION IP	PLEX PMS External IP	United States	MY EXTERNAL NETWORK IP	PLEX PMS External IP	ssl	20859	32400	58572	32400	tcp	22304	3119	19185	38	32	18	20	tcp-rst-from-client
6/3/2020 8:49	6/3/2020 8:49	MY WORKSTATION IP	99.81.213.165	Ireland	MY EXTERNAL NETWORK IP	99.81.213.165	ssl	20843	443	28074	443	tcp	12679	5457	7222	49	97	23	26	tcp-rst-from-client
6/3/2020 8:49	6/3/2020 8:49	MY WORKSTATION IP	99.81.213.165	Ireland	MY EXTERNAL NETWORK IP	99.81.213.165	ssl	20842	443	26222	443	tcp	15712	5549	10163	53	97	24	29	tcp-rst-from-client
6/3/2020 8:49	6/3/2020 8:49	MY WORKSTATION IP	99.81.213.165	Ireland	MY EXTERNAL NETWORK IP	99.81.213.165	ssl	20844	443	37443	443	tcp	12806	6363	6443	50	97	24	26	tcp-rst-from-client
6/3/2020 8:49	6/3/2020 8:49	MY WORKSTATION IP	99.81.213.165	Ireland	MY EXTERNAL NETWORK IP	99.81.213.165	ssl	20827	443	9927	443	tcp	31724	13445	18279	83	101	38	45	tcp-rst-from-client
6/3/2020 8:49	6/3/2020 8:49	MY WORKSTATION IP	99.81.213.165	Ireland	MY EXTERNAL NETWORK IP	99.81.213.165	ssl	20841	443	53585	443	tcp	12818	4730	8088	46	97	22	24	tcp-rst-from-client
6/3/2020 8:49	6/3/2020 8:49	MY WORKSTATION IP	99.81.213.165	Ireland	MY EXTERNAL NETWORK IP	99.81.213.165	ssl	20853	443	20220	443	tcp	10540	3491	7049	44	94	21	23	tcp-rst-from-client
6/3/2020 8:49	6/3/2020 8:49	MY WORKSTATION IP	99.81.213.165	Ireland	MY EXTERNAL NETWORK IP	99.81.213.165	ssl	20823	443	60119	443	tcp	49326	12744	36582	96	107	43	53	tcp-rst-from-client
6/3/2020 8:50	6/3/2020 8:50	MY WORKSTATION IP	64.233.177.94	United States	MY EXTERNAL NETWORK IP	64.233.177.94	quic	54237	443	56533	443	udp	5985	3050	2935	9	29	5	4	aged-out
6/3/2020 8:50	6/3/2020 8:50	MY WORKSTATION IP	64.233.185.156	United States	MY EXTERNAL NETWORK IP	64.233.185.156	quic	59674	443	12842	443	udp	13142	5533	7609	20	29	11	9	aged-out
6/3/2020 8:50	6/3/2020 8:50	MY WORKSTATION IP	108.177.122.157	United States	MY EXTERNAL NETWORK IP	108.177.122.157	quic	49201	443	25154	443	udp	7633	4259	3374	12	29	8	4	aged-out
6/3/2020 8:50	6/3/2020 8:50	MY WORKSTATION IP	172.104.211.98	United States	MY EXTERNAL NETWORK IP	172.104.211.98	ssl	20852	443	34940	443	tcp	6588	3598	2990	64	139	26	38	tcp-fin
6/3/2020 8:50	6/3/2020 8:50	MY WORKSTATION IP	PLEX PMS External IP	United States	MY EXTERNAL NETWORK IP	PLEX PMS External IP	ssl	20855	32400	7763	32400	tcp	6083	3022	3061	56	139	23	33	tcp-fin
6/3/2020 8:50	6/3/2020 8:50	MY WORKSTATION IP	172.217.215.104	United States	MY EXTERNAL NETWORK IP	172.217.215.104	quic	59629	443	11702	443	udp	52437	5164	47273	81	53	32	49	aged-out
6/3/2020 8:50	6/3/2020 8:50	MY WORKSTATION IP	64.233.185.156	United States	MY EXTERNAL NETWORK IP	64.233.185.156	quic	58785	443	60886	443	udp	9294	4038	5256	16	44	9	7	aged-out
6/3/2020 8:50	6/3/2020 8:50	MY WORKSTATION IP	74.125.21.154	United States	MY EXTERNAL NETWORK IP	74.125.21.154	quic	49587	443	35532	443	udp	7801	4220	3581	16	44	9	7	aged-out
6/3/2020 8:50	6/3/2020 8:50	MY WORKSTATION IP	74.125.21.97	United States	MY EXTERNAL NETWORK IP	74.125.21.97	quic	64007	443	39039	443	udp	49058	4966	44092	58	44	23	35	aged-out
6/3/2020 8:50	6/3/2020 8:50	MY WORKSTATION IP	172.217.11.142	United States	MY EXTERNAL NETWORK IP	172.217.11.142	quic	58784	443	21839	443	udp	68995	5735	63260	94	46	38	56	aged-out
6/3/2020 8:50	6/3/2020 8:50	MY WORKSTATION IP	64.233.177.94	United States	MY EXTERNAL NETWORK IP	64.233.177.94	quic	49329	443	26435	443	udp	7929	4311	3618	19	44	11	8	aged-out
6/3/2020 8:50	6/3/2020 8:50	MY WORKSTATION IP	192.0.73.2	United States	MY EXTERNAL NETWORK IP	192.0.73.2	ssl	20834	443	19781	443	tcp	9877	2055	7822	36	180	17	19	tcp-fin
6/3/2020 8:52	6/3/2020 8:52	MY WORKSTATION IP	130.211.32.175	United States	MY EXTERNAL NETWORK IP	130.211.32.175	ssl	20828	443	48424	443	tcp	10543	5996	4547	82	257	36	46	tcp-fin
6/3/2020 8:53	6/3/2020 8:53	MY WORKSTATION IP	23.11.217.181	United States	MY EXTERNAL NETWORK IP	23.11.217.181	ssl	20830	443	2363	443	tcp	7896	2586	5310	33	317	17	16	tcp-rst-from-client
6/3/2020 8:54	6/3/2020 8:54	MY WORKSTATION IP	104.18.156.41	United States	MY EXTERNAL NETWORK IP	104.18.156.41	ssl	20838	443	64228	443	tcp	8691	2407	6284	45	400	21	24	tcp-fin
6/3/2020 8:54	6/3/2020 8:54	MY WORKSTATION IP	104.17.68.195	United States	MY EXTERNAL NETWORK IP	104.17.68.195	ssl	20851	443	57307	443	tcp	8710	2529	6181	45	400	21	24	tcp-fin
4

WHEN USING GEO-BLOCKING CHINA ON USG

Receive Time	Time Logged	Source address	Destination address	Destination Country	NAT Source IP	NAT Destination IP	Application	Source Port	Destination Port	NAT Source Port	NAT Destination Port	IP Protocol	Bytes	Bytes Sent	Bytes Received	Packets	Elapsed Time (sec)	Packets Sent	Packets Received	Session End Reason
6/3/2020 10:14	6/3/2020 10:14	MY WORKSTATION IP	151.101.48.201	United States	MY EXTERNAL NETWORK IP	151.101.48.201	ssl	21582	443	47703	443	tcp	9533	1477	8056	23	0	11	12	tcp-rst-from-client
6/3/2020 10:14	6/3/2020 10:14	MY WORKSTATION IP	104.100.217.236	United States	MY EXTERNAL NETWORK IP	104.100.217.236	lastpass	21580	443	1761	443	tcp	15312	3051	12261	50	41	23	27	tcp-rst-from-server
6/3/2020 10:15	6/3/2020 10:15	MY WORKSTATION IP	54.72.196.93	Ireland	MY EXTERNAL NETWORK IP	54.72.196.93	ssl	21602	443	34094	443	tcp	9461	3042	6419	24	1	12	12	tcp-fin
6/3/2020 10:15	6/3/2020 10:15	MY WORKSTATION IP	54.161.19.10	United States	MY EXTERNAL NETWORK IP	54.161.19.10	ssl	21586	443	23488	443	tcp	12117	2060	10057	36	60	17	19	tcp-fin
6/3/2020 10:15	6/3/2020 10:15	MY WORKSTATION IP	151.139.128.14	United States	MY EXTERNAL NETWORK IP	151.139.128.14	ocsp	21589	80	33632	80	tcp	2775	1109	1666	24	65	12	12	tcp-fin
6/3/2020 10:15	6/3/2020 10:15	MY WORKSTATION IP	104.18.156.41	United States	MY EXTERNAL NETWORK IP	104.18.156.41	ssl	21606	443	2133	443	tcp	6058	1477	4581	22	0	11	11	tcp-rst-from-client
6/3/2020 10:15	6/3/2020 10:15	MY WORKSTATION IP	104.18.156.41	United States	MY EXTERNAL NETWORK IP	104.18.156.41	ssl	21607	443	32160	443	tcp	6058	1477	4581	22	0	11	11	tcp-rst-from-client
6/3/2020 10:15	6/3/2020 10:15	MY WORKSTATION IP	104.18.156.41	United States	MY EXTERNAL NETWORK IP	104.18.156.41	ssl	21608	443	49965	443	tcp	6058	1477	4581	22	0	11	11	tcp-rst-from-client
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	PLEX PMS External  IP 	United States	MY EXTERNAL NETWORK IP	PLEX PMS External  IP 	incomplete	21624	32400	48273	32400	tcp	66	66	0	1	0	1	0	aged-out
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	99.81.213.165	Ireland	MY EXTERNAL NETWORK IP	99.81.213.165	web-browsing	21594	80	1675	80	tcp	2099	1056	1043	23	66	12	11	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	PLEX PMS Internal IP 	Non-Routeable Address	MY EXTERNAL NETWORK IP	PLEX PMS Internal IP 	incomplete	21623	32400	14543	32400	tcp	176	66	110	2	0	1	1	aged-out
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	PLEX PMS Internal IP 	Non-Routeable Address	MY EXTERNAL NETWORK IP	PLEX PMS Internal IP 	incomplete	21625	32400	37003	32400	tcp	176	66	110	2	0	1	1	aged-out
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	PLEX PMS External  IP 	United States	MY EXTERNAL NETWORK IP	PLEX PMS External  IP 	incomplete	21622	32400	16284	32400	tcp	66	66	0	1	0	1	0	aged-out
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	54.239.180.35	United States	MY EXTERNAL NETWORK IP	54.239.180.35	ssl	21576	443	25335	443	tcp	9873	2985	6888	45	115	23	22	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	72.21.91.29	United States	MY EXTERNAL NETWORK IP	72.21.91.29	ocsp	21578	80	30256	80	tcp	3173	1409	1764	32	116	17	15	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	104.18.21.226	United States	MY EXTERNAL NETWORK IP	104.18.21.226	ocsp	21584	80	46354	80	tcp	4662	1416	3246	33	115	17	16	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	PLEX PMS Internal IP 	Non-Routeable Address	MY EXTERNAL NETWORK IP	PLEX PMS Internal IP 	incomplete	21631	32400	13118	32400	tcp	352	132	220	4	3	2	2	aged-out
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	PLEX PMS Internal IP 	Non-Routeable Address	MY EXTERNAL NETWORK IP	PLEX PMS Internal IP 	incomplete	21629	32400	13784	32400	tcp	352	132	220	4	3	2	2	aged-out
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	54.72.196.93	Ireland	MY EXTERNAL NETWORK IP	54.72.196.93	ssl	21611	443	32373	443	tcp	24910	18191	6719	38	1	21	17	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	PLEX PMS External  IP 	United States	MY EXTERNAL NETWORK IP	PLEX PMS External  IP 	incomplete	21628	32400	47276	32400	tcp	132	132	0	2	3	2	0	aged-out
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	PLEX PMS External  IP 	United States	MY EXTERNAL NETWORK IP	PLEX PMS External  IP 	incomplete	21630	32400	10592	32400	tcp	132	132	0	2	3	2	0	aged-out
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	54.72.196.93	Ireland	MY EXTERNAL NETWORK IP	54.72.196.93	ssl	21615	443	53287	443	tcp	11323	4964	6359	22	1	11	11	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	54.72.196.93	Ireland	MY EXTERNAL NETWORK IP	54.72.196.93	ssl	21614	443	17447	443	tcp	9410	2991	6419	23	0	11	12	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	PLEX PMS Internal IP 	Non-Routeable Address	MY EXTERNAL NETWORK IP	PLEX PMS Internal IP 	incomplete	21629	32400	2363	32400	tcp	176	66	110	2	0	1	1	aged-out
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	PLEX PMS External  IP 	United States	MY EXTERNAL NETWORK IP	PLEX PMS External  IP 	incomplete	21628	32400	11844	32400	tcp	66	66	0	1	0	1	0	aged-out
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	PLEX PMS External  IP 	United States	MY EXTERNAL NETWORK IP	PLEX PMS External  IP 	incomplete	21630	32400	37095	32400	tcp	66	66	0	1	0	1	0	aged-out
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	PLEX PMS Internal IP 	Non-Routeable Address	MY EXTERNAL NETWORK IP	PLEX PMS Internal IP 	incomplete	21631	32400	44736	32400	tcp	176	66	110	2	0	1	1	aged-out
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	172.105.96.32	Canada	MY EXTERNAL NETWORK IP	172.105.96.32	ssl	21621	443	54048	443	tcp	7068	2156	4912	25	2	12	13	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	173.230.133.75	United States	MY EXTERNAL NETWORK IP	173.230.133.75	ssl	21635	8443	55614	8443	tcp	262833	17995	244838	281	6	92	189	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	173.230.133.75	United States	MY EXTERNAL NETWORK IP	173.230.133.75	ssl	21632	8443	15803	8443	tcp	188699	17962	170737	218	11	75	143	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	173.230.133.75	United States	MY EXTERNAL NETWORK IP	173.230.133.75	ssl	21637	8443	19215	8443	tcp	8854737	176775	8677962	8643	19	2686	5957	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	54.230.251.199	United States	MY EXTERNAL NETWORK IP	54.230.251.199	ocsp	21601	80	17158	80	tcp	3263	1358	1905	30	100	16	14	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	173.230.133.75	United States	MY EXTERNAL NETWORK IP	173.230.133.75	ssl	21638	8443	38674	8443	tcp	1286451	34741	1251710	1303	21	431	872	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	192.0.73.2	United States	MY EXTERNAL NETWORK IP	192.0.73.2	ssl	21612	443	38941	443	tcp	9458	1927	7531	29	43	14	15	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	185.199.108.153	United States	MY EXTERNAL NETWORK IP	185.199.108.153	ssl	21585	443	5850	443	tcp	8046	2233	5813	34	158	18	16	tcp-rst-from-client
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	198.70.69.50	United States	MY EXTERNAL NETWORK IP	198.70.69.50	web-browsing	21572	80	39205	80	tcp	3972	1926	2046	42	159	22	20	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	173.230.133.75	United States	MY EXTERNAL NETWORK IP	173.230.133.75	ssl	21634	8443	32117	8443	tcp	68197	7650	60547	96	21	37	59	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	54.230.75.127	United States	MY EXTERNAL NETWORK IP	54.230.75.127	ssl	21579	443	40707	443	tcp	87489	4725	82764	125	159	59	66	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	99.81.213.165	Ireland	MY EXTERNAL NETWORK IP	99.81.213.165	ssl	21620	443	48899	443	tcp	27406	5757	21649	66	38	27	39	tcp-rst-from-client
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	99.81.213.165	Ireland	MY EXTERNAL NETWORK IP	99.81.213.165	ssl	21595	443	45910	443	tcp	57554	13691	43863	123	112	56	67	tcp-rst-from-client
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	151.101.48.201	United States	MY EXTERNAL NETWORK IP	151.101.48.201	ssl	21581	443	2581	443	tcp	24274	3028	21246	57	158	30	27	tcp-rst-from-client
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	198.70.69.50	United States	MY EXTERNAL NETWORK IP	198.70.69.50	web-browsing	21573	80	10767	80	tcp	3982	1936	2046	42	159	22	20	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	72.21.91.29	United States	MY EXTERNAL NETWORK IP	72.21.91.29	ocsp	21596	80	10255	80	tcp	3174	1409	1765	32	112	17	15	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	151.101.48.217	United States	MY EXTERNAL NETWORK IP	151.101.48.217	vimeo-base	21605	443	1999	443	tcp	21579	2466	19113	49	61	23	26	tcp-rst-from-client
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	173.230.133.75	United States	MY EXTERNAL NETWORK IP	173.230.133.75	ssl	21633	8443	45813	8443	tcp	16494	2634	13860	53	23	23	30	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	99.81.213.165	Ireland	MY EXTERNAL NETWORK IP	99.81.213.165	ssl	21619	443	18962	443	tcp	16270	5908	10362	54	38	24	30	tcp-rst-from-client
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	172.105.96.32	Canada	MY EXTERNAL NETWORK IP	172.105.96.32	ssl	21627	443	30609	443	tcp	7901	2519	5382	36	36	16	20	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	104.18.157.41	United States	MY EXTERNAL NETWORK IP	104.18.157.41	ssl	21597	443	3596	443	tcp	4064816	92497	3972319	4237	108	1383	2854	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	104.17.67.195	United States	MY EXTERNAL NETWORK IP	104.17.67.195	ssl	21626	443	17430	443	tcp	8950	2751	6199	35	37	16	19	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	185.199.111.153	United States	MY EXTERNAL NETWORK IP	185.199.111.153	ssl	21583	443	34808	443	tcp	7876	2298	5578	34	158	19	15	tcp-rst-from-client
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	173.230.133.75	United States	MY EXTERNAL NETWORK IP	173.230.133.75	ssl	21636	8443	9333	8443	tcp	78366	9544	68822	109	21	43	66	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	54.230.75.68	United States	MY EXTERNAL NETWORK IP	54.230.75.68	ssl	21593	443	57133	443	tcp	9192	2285	6907	38	114	19	19	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	99.81.213.165	Ireland	MY EXTERNAL NETWORK IP	99.81.213.165	ssl	21616	443	60033	443	tcp	16370	5559	10811	53	38	24	29	tcp-rst-from-client
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	99.81.213.165	Ireland	MY EXTERNAL NETWORK IP	99.81.213.165	ssl	21599	443	10155	443	tcp	34215	11351	22864	94	101	43	51	tcp-rst-from-client
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	99.81.213.165	Ireland	MY EXTERNAL NETWORK IP	99.81.213.165	ssl	21617	443	57427	443	tcp	17892	4809	13083	53	38	24	29	tcp-rst-from-client
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	192.0.77.2	United States	MY EXTERNAL NETWORK IP	192.0.77.2	ssl	21613	443	36810	443	tcp	10043	1935	8108	31	43	15	16	tcp-fin
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	151.101.49.132	United States	MY EXTERNAL NETWORK IP	151.101.49.132	ssl	21598	443	28481	443	tcp	36527	3669	32858	71	101	37	34	tcp-rst-from-client
6/3/2020 10:16	6/3/2020 10:16	MY WORKSTATION IP	99.81.213.165	Ireland	MY EXTERNAL NETWORK IP	99.81.213.165	ssl	21618	443	18933	443	tcp	16182	4824	11358	54	38	24	30	tcp-rst-from-client
5

Can you provide server logs. ( and client logs if you mean signing into on of those). Also to be clear we don’t have anything that goes through China. One of our devops guys blocks china himself and has no issues.

6

Well thats good to know, that at least rules out one thing. I would not be shocked if a IP range was accidentally included in the block of addresses of something as expansive as the China IP list. Its a large hammer something is bound to get in the way… The question is now… which IP.

– As far as the server logs maybe… I’m going to have to go through it and remove/examine identifiable data I’m addressing some work issue atm so when I can do that I will. Question I’m not likely to post that in a forum and as you may see I dont contribute to the forums often. How do I provide those to you? —

I’ll likely work this weekend setting up a PMS on the palo network so I can see all the traffic server side as I do client side. Hopefully it should show up.

7

you’re welcome to click on my username and message them to me.

8

Plex_Logs
Plex_Logs751×426 85.4 KB

Note: The indication of Indirect vs Remote are on the same client, same browser.

The following logs provided show both the client side actions when an IP address is blocked. I haven’t actually reviewed the logs in detail yet… I’m a bit burned out removing all the identifiable data and there was A LOT of it. I’m sure I missed something, but should be enough provided

. – I will likley still put up a PMS on a different network and parse the Palo logs to determine the IP range that the USG is blocking. Although the logs here may indicate that. I’m pretty sure after some review it has to do with token validation, when a one of the Plex systems sends a request to be validated it is getting rejected (becausee of the block put into place).

IT WOULD BE SUPER NICE FOR PLEX TO PROVIDE IP RANGES TO WHITELIST

These logs represent both client and server side actions at the same time, should be somewhat easy to directly correlate and action on the client with the server logs.

Client Logs When Unknown IP Range Is Blocked
Client_IP-Block_REDACTED.7z (5.5 KB)
Server Logs When Unknown IP Range Is Blocked
PSM-Log_IP-Block_REDACTED.7z (53.3 KB)

Client Logs When No Block Is Place
I was too lazy to sanitize the server ‘no block’ logs. Here are the client based ones… One thing is for sure that whole relay process is very very very messy. By comparison the direct is super clean… the relay stuff looks like the result of spaghetti code one would find on a 20yr old MUD.

Client_IP-No-Block_REDACTED.7z (5.6 KB)

[Notes:] These logs where obtained in this manner

  • Turn on PMS
  • Remote in to a location and log onto plex.tv with another plex account (not the one used for the PMS server)
  • Access Film and play
  • Stop play
  • Kill PMS
  • On the Remote client: Copy log files on client within the UI interface
  • On the PMS goto the log folder and grab Plex Media Server.log
9

Given the amount of effort to anonymize the logs I just thoughts I’d post them… someone else might see something I’ve missed.