Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a fresh install of CentOS 4.8 running on an internal development server. I haven't done anything to it besides setting up sudoers and SSH. I can SSH into the server and from there resolve domains to IPs and ping internal servers, but for some reason I don't get any response from pinging external servers.

The software firewall is disabled, and the problem is present with both static and DHCP-assigned network configurations. The network domain controller is a Windows Server 2003 box.

$ nslookup

Non-authoritative answer:
<etc...> is the Win2K3 server.

$ ping
PING ( 56(84) bytes of data.

It just hangs here indefinitely.

$ cat /etc/resolv.conf
; generated by /sbin/dhclient-script
search <...snip...>.local
nameserver is the backup DC server, which is currently off and tombstoned by this point. The snipped section is our company name.

# ifconfig
eth0      Link encap:Ethernet  HWaddr <snip>
          inet addr:  Bcast:  Mask:
          inet6 addr: <snip>/64 Scope:Link
          RX packets:80066 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4421 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:7810133 (7.4 MiB)  TX bytes:590550 (576.7 KiB)
          Interrupt:225 Base address:0xc000

lo        Link encap:Local Loopback
          inet addr:  Mask:
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:32 errors:0 dropped:0 overruns:0 frame:0
          TX packets:32 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:8104 (7.9 KiB)  TX bytes:8104 (7.9 KiB)

# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface   U     0      0        0 eth0     U     0      0        0 eth0         UG    0      0        0 eth0

And, for good measure, a snapshot of the current ethernet config via the system-config-network GUI.

Edit: I don't yet have enough rep to post images, so here's a link. Sorry!
system-config-network snapshot

I'm pretty green when it comes to setting up *nix dev servers and network configuration in general, so please let me know if I've left out critical information, or posted information I shouldn't have posted.


share|improve this question

3 Answers 3

Nothing requires that ping be possible between two hosts. It might be that somebody between you and google is dropping ICMP packets. If everything else is working I'd not worry much about this.

If you are particularly worried check with whoever runs your networking equipment or firewall and see if they are letting ICMP traffic through. Also check to see if you can ping anybody else in the outside world other than google?

share|improve this answer
While all of the Windows workstations seem to be able to access the internet just fine (in spite of the inability to ping and trace route), the development server I started the thread about is a different story. It has all the same symptoms (inability to ping, etc.) but it can't access the outside world via browser, even though it can see, connect to and ping any internal machine and resolve external IPs. We're unable to ping any outside server. At this point I guess it's an issue with our ASA. – Beco Jul 17 '10 at 18:35

Check your local netfilter rules:

iptables -L -n

If there are no rules affecting ICMP and it is otherwise routing, as it appears to be due to DNS resolution, there is likely some filtering occurring at either or its next hop.


Based on your update, it looks like you have local firewall rules on the Linux server preventing the ping.

To remove all rules:

iptables -F
iptables -X

They will likely return on reboot. I suspect they are managed by an init script. I'm guessing to disable the init script:

/sbin/chkconfig iptables off

This varies between distributions. I wrote a quick introduction to iptables in a previous answer:

Typically, simply disabling the firewall is not well advised. However, it does look you are using intranet routable addressing, and your description indicates that you probably already have a firewall further up the route. Be cautious about your actions unless you understand the potential risks of what you are undertaking.

share|improve this answer
Running that command results in a long list of rules, with the pertinent one (I believe) being: REJECT all -- reject-with icmp-host-prohibited I assume that is the ICMP rule you were referring to. I guess I need to go learn how to modify iptables rules. – Beco Jul 12 '10 at 20:09
Please see my edit. – Warner Jul 12 '10 at 20:15
Hmm, I was able to confirm that the rules had been removed (running iptables -L -n returns a bunch of empty chains now), but even after restarting the network service and rebooting the machine (I also ran /sbin/chkconfig iptables off), I still can't ping external servers. I'm becoming increasingly aware that I'm in way over my head. – Beco Jul 12 '10 at 20:31
Can the DC with the .2.5 address ping google? – Warner Jul 12 '10 at 20:47
I was all set to say, "Psh, of course!" but as it turns out, no. It can access Google (and the rest of the internet) via browser seemingly unhindered, but it cannot ping Google (or any other external server). In fact, none of the machines on the local network can, but they can all access the internet via browser. – Beco Jul 12 '10 at 21:05

This looks like a routing and/or firewall problem.

How do you connect to the Internet? Is (your default gateway) also your Internet gateway, or do you have other routing in the middle before you can actually reach your perimeter firewall? How is/are your firewall/s configured?

Please post the output of a traceroute -n, so we can see where your packets are actually being blocked.

share|improve this answer
Hmm... I guess I'm in over my head. We're a really small web development shop without an IT guy, and our internal network was set up by a third party long ago. All I really know is that we have a router connected to a cable modem, and that connection is split among all of our machines (including the DC) via gigabit switches. # traceroute -n traceroute: Warning: has multiple addresses; using traceroute to (, 30 hops max, 38 byte packets 1 * * * 2 * * * – Beco Jul 12 '10 at 20:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.