Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a fresh install of CentOS 4.8 running on an internal development server. I haven't done anything to it besides setting up sudoers and SSH. I can SSH into the server and from there resolve domains to IPs and ping internal servers, but for some reason I don't get any response from pinging external servers.

The software firewall is disabled, and the problem is present with both static and DHCP-assigned network configurations. The network domain controller is a Windows Server 2003 box.

$ nslookup google.com
Server:         10.254.2.5
Address:        10.254.2.5#53

Non-authoritative answer:
Name:   google.com
Address: 74.125.47.147
Name:   google.com
Address: 74.125.47.99
<etc...>

10.254.2.5 is the Win2K3 server.

$ ping google.com
PING google.com (74.125.47.106) 56(84) bytes of data.

It just hangs here indefinitely.

$ cat /etc/resolv.conf
; generated by /sbin/dhclient-script
search <...snip...>.local
nameserver 10.254.2.5
nameserver 10.254.2.124

10.254.2.124 is the backup DC server, which is currently off and tombstoned by this point. The snipped section is our company name.

# ifconfig
eth0      Link encap:Ethernet  HWaddr <snip>
          inet addr:10.254.2.101  Bcast:10.254.2.255  Mask:255.255.255.0
          inet6 addr: <snip>/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:80066 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4421 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:7810133 (7.4 MiB)  TX bytes:590550 (576.7 KiB)
          Interrupt:225 Base address:0xc000

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:32 errors:0 dropped:0 overruns:0 frame:0
          TX packets:32 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:8104 (7.9 KiB)  TX bytes:8104 (7.9 KiB)

# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.254.2.0      0.0.0.0         255.255.255.0   U     0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 eth0
0.0.0.0         10.254.2.5      0.0.0.0         UG    0      0        0 eth0

And, for good measure, a snapshot of the current ethernet config via the system-config-network GUI.

Edit: I don't yet have enough rep to post images, so here's a link. Sorry!
system-config-network snapshot

I'm pretty green when it comes to setting up *nix dev servers and network configuration in general, so please let me know if I've left out critical information, or posted information I shouldn't have posted.

Thanks!

share|improve this question

3 Answers 3

Check your local netfilter rules:

iptables -L -n

If there are no rules affecting ICMP and it is otherwise routing, as it appears to be due to DNS resolution, there is likely some filtering occurring at either 10.254.2.5 or its next hop.

Edit

Based on your update, it looks like you have local firewall rules on the Linux server preventing the ping.

To remove all rules:

iptables -F
iptables -X

They will likely return on reboot. I suspect they are managed by an init script. I'm guessing to disable the init script:

/sbin/chkconfig iptables off

This varies between distributions. I wrote a quick introduction to iptables in a previous answer:

http://serverfault.com/questions/158772/can-you-recommend-a-good-intro-to-iptables/158774#158774

Typically, simply disabling the firewall is not well advised. However, it does look you are using intranet routable addressing, and your description indicates that you probably already have a firewall further up the route. Be cautious about your actions unless you understand the potential risks of what you are undertaking.

share|improve this answer
    
Running that command results in a long list of rules, with the pertinent one (I believe) being: REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited I assume that is the ICMP rule you were referring to. I guess I need to go learn how to modify iptables rules. –  Beco Jul 12 '10 at 20:09
    
Please see my edit. –  Warner Jul 12 '10 at 20:15
    
Hmm, I was able to confirm that the rules had been removed (running iptables -L -n returns a bunch of empty chains now), but even after restarting the network service and rebooting the machine (I also ran /sbin/chkconfig iptables off), I still can't ping external servers. I'm becoming increasingly aware that I'm in way over my head. –  Beco Jul 12 '10 at 20:31
    
Can the DC with the .2.5 address ping google? –  Warner Jul 12 '10 at 20:47
    
I was all set to say, "Psh, of course!" but as it turns out, no. It can access Google (and the rest of the internet) via browser seemingly unhindered, but it cannot ping Google (or any other external server). In fact, none of the machines on the local network can, but they can all access the internet via browser. –  Beco Jul 12 '10 at 21:05

This looks like a routing and/or firewall problem.

How do you connect to the Internet? Is 10.254.2.5 (your default gateway) also your Internet gateway, or do you have other routing in the middle before you can actually reach your perimeter firewall? How is/are your firewall/s configured?

Please post the output of a traceroute -n google.com, so we can see where your packets are actually being blocked.

share|improve this answer
    
Hmm... I guess I'm in over my head. We're a really small web development shop without an IT guy, and our internal network was set up by a third party long ago. All I really know is that we have a router connected to a cable modem, and that connection is split among all of our machines (including the DC) via gigabit switches. # traceroute -n google.com traceroute: Warning: google.com has multiple addresses; using 74.125.67.103 traceroute to google.com (74.125.67.103), 30 hops max, 38 byte packets 1 * * * 2 * * * –  Beco Jul 12 '10 at 20:05

Nothing requires that ping be possible between two hosts. It might be that somebody between you and google is dropping ICMP packets. If everything else is working I'd not worry much about this.

If you are particularly worried check with whoever runs your networking equipment or firewall and see if they are letting ICMP traffic through. Also check to see if you can ping anybody else in the outside world other than google?

share|improve this answer
    
While all of the Windows workstations seem to be able to access the internet just fine (in spite of the inability to ping and trace route), the development server I started the thread about is a different story. It has all the same symptoms (inability to ping, etc.) but it can't access the outside world via browser, even though it can see, connect to and ping any internal machine and resolve external IPs. We're unable to ping any outside server. At this point I guess it's an issue with our ASA. –  Beco Jul 17 '10 at 18:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.