1

I'm unable to hit my server from a browser on another machine (it gives a 'connection has timed out' error), although typing http://localhost or http://my-ip-here works from the browser within the machine. I can ping and ssh into the server from other machines; it just seems like apache is rejecting the port-80 browser connections.

What can I do to further diagnose/fix this problem? Thanks in advance for your help.

edit: there is no firewall. This is my default site:

keone@kserver:/etc/apache2/sites-enabled$ ls -l
total 0
lrwxrwxrwx 1 root root 26 2010-12-16 15:20 000-default -> ../sites-available/default

keone@kserver:/etc/apache2/sites-available$ cat default
<VirtualHost *:80>
    ServerAdmin webmaster@localhost

    DocumentRoot /var/www/manual
    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>
    <Directory /var/www/>
        Options FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all
    </Directory>

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/access.log combined

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>

</VirtualHost>

also, this and this post seems to verify no firewall:

keone@kserver:/etc/apache2$ sudo /sbin/iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
keone@kserver:/etc/apache2$ sudo /sbin/iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

4 Answers 4

1

It might also he helpful to run tcpdump on both the client and the server and see if the packets are getting through

typical switches: tcpdump -i -n -p port 80

-n = don't resolve hostnames -p = non-promiscuous mode

Another thing to check is the listen directives in your apache config, try: grep -ir listen /etc/httpd/ thise should be something like *:80 or one each for your ip-address:80

2
  • thank you; this helped me debug the problem. actually, it turned out that a firewall on my client machine was blocking connections to the server. I opened another client machine (actually to use tcpdump, since I couldn't figure out how to do it on windows, which was the original client) and realized that everything seemed to work. :O grepping for listen helped verify that there was only one listen command (so no conflicts) and that it was enabled, and tcpdump (I had to specify an interface, in this case eth1) was useful for verifying connections on the 'good' client
    – unsorted
    Jan 10, 2011 at 18:41
  • Wireshark is a graphical interface to libpcap (which is what tcpdump uses). Wireshark is great on windows or in the GUI on unix. It is also great if you use tcpdump to capture packets on a remote unix machine, save the capture to a file, then load it in wireshark, it has a graphical filter constructor, and is just easier to read than the raw packets. It also interprets most common packet types, like DNS, HTTP, etc.
    – Allan Jude
    Jan 10, 2011 at 20:57
1

You need to check the firewall running on the machine that apache sits on- its probable that it's blocking port 80. Once this is unblocked, you should be able to reach this from another machine.

1
  • I don't think there is a firewall. I didn't install one, and ubuntu seems to have ufw disabled by default. I tried disabling it for sure (sudo ufw disable) and retrying, and it still fails.
    – unsorted
    Jan 10, 2011 at 16:56
0
  1. Turn of firewall (temp.. later, you can fix your rules) (or allow port 80 connections).
  2. from a remote machine, Ping/traceroute to the IP (where apache runs).

Steps 1, 2 should give you an idea of where the problem is. Also, check your apache config.. make sure Allow from localhost/Deny from all is not mentioned in the config of your default site.

1
  • no firewall. as for ping/traceroute, I can indeed ping the server, and traceroute gives a couple of hops before getting to the server... what should I be inferring from this information, aside from the fact that ping seems to work? as for the apache config, see my edited question. it's allow from all as far as I can tell.
    – unsorted
    Jan 10, 2011 at 17:04
0

On your client machine, telnet to the server on port 80.

If the results are connection refused, then the only causes of that are firewall block (you say its off) or Apache isn't running on the public IP.

If the results are time-out, and ping is working, I can't see of any other reason than firewall.

If it connects, then you've reached Apache at least and know the problem is on that side.

1
  • Also the firewall isn't necessarily on your Linux server, it could be before it in the network ? Jan 10, 2011 at 17:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .