Jtdcftul

At some point yesterday the functions: file_get_contents, get_headers, and curl have stopped working with error: Connection refused. Ex:

Curl: (7) Failed to connect to www.alebalweb.com port 443: Connection refused.

I do not understand why, I was just uploading files and no one touched anything on the server. Until a moment before everything worked and it worked for years.
With Curl, I do the cronjob of my site once a day, and never had any problems.
I thought the SSL certificates had expired, but it seems not. The site is online and it works, if I try to access the site via curl from my local PC, curl works smoothly. I thought I was banned at UFW or fail2ban for some reason, but I changed my local IP and nothing changed. And anyway I see a lot of errors in the Apache logs, from many different IPs.
The problem occurs on all sites on my server.

I really can't understand what could have happened, everything worked perfectly until yesterday afternoon.

The Server is Ubuntu 18.04 on vultr.

I also found some strange errors in syslog, probably related.

Apr  8 06:25:03 Vultr_LA_18 rsyslogd:  [origin software="rsyslogd" swVersion="8.32.0" x-pid="689" x-info="http://www.rsyslog.com"] rsyslogd was HUPed

Apr  8 06:25:07 Vultr_LA_18 popularity-contest: unable to submit report to https://popcon.ubuntu.com/popcon-submit.cgi.

Apr  8 06:25:07 Vultr_LA_18 popularity-contest: unable to submit report.





Apr  8 06:32:04 Vultr_LA_18 rsyslogd: unexpected GnuTLS error -53 - this could be caused by a broken connection. GnuTLS reports: Error in the push function.   [v8.32.0$

Apr  8 06:32:04 Vultr_LA_18 rsyslogd: omfwd: TCPSendBuf error -2078, destruct TCP Connection to log.nixstats.com:10514 [v8.32.0 try http://www.rsyslog.com/e/2078 ]

Apr  8 06:32:04 Vultr_LA_18 rsyslogd: action 'action 1' suspended (module 'builtin:omfwd'), retry 0. There should be messages before this one giving the reason for sus$

Apr  8 06:32:04 Vultr_LA_18 rsyslogd: action 'action 1' resumed (module 'builtin:omfwd') [v8.32.0 try http://www.rsyslog.com/e/2359 ]



Apr  8 06:36:06 Vultr_LA_18 systemd-resolved[631]: Server returned error NXDOMAIN, mitigating potential DNS violation DVE-2018-0001, retrying transaction with reduced $

I reset Fail2ban, and something seems to have come back to work...

But I have absolutely no idea how the server managed to block itself via Fail2ban...

Any ideas? Above all, any ideas to prevent this from happening again in the future?