Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I can't seem to ping or ssh to an outside domain. Internal IP addresses work fine. It resolves the IP address, so I don't think it is DNS. The local host seems to intercept my requests somehow. Curl works. This is ubuntu server 10.4. My internal IP is 192.168.1.14.

EDIT: I stopped ufw via stop ufw and added some more info below.

matt@valkyrie:~$ ping google.com
PING google.com (173.194.33.104) 56(84) bytes of data.
From valkyrie (192.168.1.14) icmp_seq=1 Destination Port Unreachable
From valkyrie (192.168.1.14) icmp_seq=2 Destination Port Unreachable
From valkyrie (192.168.1.14) icmp_seq=3 Destination Port Unreachable
From valkyrie (192.168.1.14) icmp_seq=4 Destination Port Unreachable
From valkyrie (192.168.1.14) icmp_seq=5 Destination Port Unreachable
From valkyrie (192.168.1.14) icmp_seq=6 Destination Port Unreachable
^C
--- google.com ping statistics ---
6 packets transmitted, 0 received, +6 errors, 100% packet loss, time 4999ms

Default route

root@valkyrie:/etc/nagios3# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
0.0.0.0         192.168.1.1     0.0.0.0         UG    100    0        0 eth0

Traceroute

root@valkyrie:/etc/nagios3# traceroute google.com
traceroute to google.com (173.194.33.104), 30 hops max, 60 byte packets
 1  valkyrie (192.168.1.14)  0.409 ms  0.459 ms  0.481 ms

iptables

root@valkyrie:/etc/nagios3# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
blockcontrol_in  all  --  anywhere             anywhere            state NEW mark match !0x14 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
blockcontrol_fw  all  --  anywhere             anywhere            state NEW mark match !0x14 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
blockcontrol_out  all  --  anywhere             anywhere            state NEW mark match !0x14 

Chain blockcontrol_fw (1 references)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            mark match 0xa 
RETURN     all  --  anywhere             arbiter             
RETURN     all  --  192.168.1.0/24       192.168.1.0/24      
NFQUEUE    all  --  anywhere             anywhere            NFQUEUE num 92

Chain blockcontrol_in (1 references)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            mark match 0xa 
RETURN     all  --  anywhere             anywhere            
RETURN     all  --  192.168.1.0/24       anywhere            
NFQUEUE    all  --  anywhere             anywhere            NFQUEUE num 92

Chain blockcontrol_out (1 references)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            mark match 0xa reject-with icmp-port-unreachable 
RETURN     all  --  anywhere             anywhere            
RETURN     all  --  anywhere             arbiter             
RETURN     all  --  anywhere             192.168.1.0/24      
RETURN     tcp  --  anywhere             anywhere            tcp dpt:https 
RETURN     tcp  --  anywhere             anywhere            tcp dpt:www 
NFQUEUE    all  --  anywhere             anywhere            NFQUEUE num 92
share|improve this question
    
Oooh, looks like REJECT all -- anywhere anywhere mark match 0xa reject-with icmp-port-unreachable might have something to do with it. –  Matt Williamson Aug 18 '10 at 19:21
add comment

4 Answers

up vote 2 down vote accepted

Can you curl google? If so, it's likely either PING or ICMP is blocked outgoing. Determine which by trying to do a traceroute to google.com traceroute google.com and see if that also fails. Then check your software firewall - if you have iptables try iptables -L and paste the output, although Ubuntu might come with a different firewall by default. If that has nothing, contact your hosting provider or ISP and ask them if they are blocking ICMP outbound.

share|improve this answer
    
Curl works. It's not the ISP because I can perform all these tasks on my macbook. I'll paste in my traceroute and iptables in my original question. –  Matt Williamson Aug 18 '10 at 19:16
    
This is almost definitely iptables –  Matt Williamson Aug 18 '10 at 19:26
    
I had to delete two entries: NFQUEUE all -- anywhere anywhere NFQUEUE num 92 and REJECT all -- anywhere anywhere mark match 0xa reject-with icmp-port-unreachable –  Matt Williamson Aug 18 '10 at 19:31
    
I may be spamming at this point, but it seems moblock a P2P protection daemon was inserting all the iptable records causing the problems. –  Matt Williamson Aug 18 '10 at 19:38
add comment

You could see this if you don't have a default gateway set. Try route -n to see your routing table.

share|improve this answer
    
added the output of route -n to my question –  Matt Williamson Aug 18 '10 at 19:20
add comment

There's a misconfiguration somewhere, probably on the server or the router, as ICMP doesn't use ports but your ping response indicates "port unreachable". You can run a packet capture on the server and ping again and look at the ICMP code returned with the response to determine what's happening. If it is in fact code 3 (port unreachable) then there's something flaky somewhere.

I would almost think it's a routing loop but that would typically generate a "TTL expired in transit" response.

share|improve this answer
add comment

there's likely a firewall between you and your ISP blocking ICMP communication, or your ISP is having issues.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.