Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our Debian 6 server (with Aegir) is not accesible from our own network. From every other IP than ours it is though.

I tried to remove our IP from iptables with the following command:

iptables -D INPUT -s 00.00.00.00 -j DROP

But our IP does not seem to exist in the chain.

How can I lookup what ip addresses are blocked? What else can be the problem?

share|improve this question
    
May it have naything to do with IPV6 ? –  alci Jul 12 '11 at 10:35
    
Perhaps a routing problem? Can you include the output of route -n in your question? –  Flimzy Jul 12 '11 at 10:42
    
You might like to fix up your title and tags; I'm fairly confident this isn't a Debian-specific problem. –  womble Jul 12 '11 at 10:44
    
If your iptables rules are set to log drop / reject packets, check /var/log/messages for those log entries. Also do iptables -L -n to list current rules. –  Mike Insch Jul 12 '11 at 10:45

2 Answers 2

This is a simple network diagnostic problem.

Start by determining how far the packets are getting. Use tcpdump on the sending machine to make sure the packets are getting generated and sent, then tcpdump on the receiving machine to see if the packets are arriving. If there are intermediate routers or firewalls, you can tcpdump from those too (all decent appliance routers have some sort of capability for instrumenting at least flows, if not individual packets). With a managed switch, you can use a mirror port to see if the packets are going through the switch (although for a simple problem like this, it should be unnecessary). Worst case, if you suspect an intermediate hop, a traceroute can be a reasonable diagnostic tool, and if it's a TCP service that's causing problems, then a tcptraceroute is about 100 times better.

Once you've determined how far the packets are getting, you can examine the offending machine itself. The firewall at one end is by far the most likely candidate; iptables -L -v will show packet counts alongside the rules, to show which rules are getting used. If a firewall rule is actually getting hit, it should show up fairly clearly. If you have default DROP rules (a good idea), you should also put a LOG message in the chain to show when the default is being hit.

Given that you haven't provided any description of what you're actually trying to do (ping, connecting to a TCP service, whatever), nor what exactly constitutes "not accessible", it's tough to describe what else to check. For a TCP service, ensure that there's no tcpwrappers getting in the way, and that the service is bound on the correct port and IP (netstat -ltnp).

Beyond that, more specific diagnostic details will require more details of the problem. Be very specific as to what you're trying to do, and maybe someone can provide you the right answer.

share|improve this answer
    
Hi Womble, thank you very much for your extensive answer. Unfortunately my knowledge does not reach far enough yet to find out what's going on and how to get and provide more details than this: I'm trying to visit our website, but the connection times out. I'm trying to connect through SSH, but the connection times out. If I use another internet connection I can access the website and server. Excuse me for the noobness. –  Ben Rogmans Jul 12 '11 at 11:52

Are you using the same IP within your network and outside your network? If your router or firewall uses NAT to convert the public IP address to a private IP address like 192.168.1.200, then your router may not be able to do this conversion for connections starting inside your network. If that's the case, inside your network you would need to use the private IP address and outside your network you would need to use the public IP address.

If you're using hostnames and have this problem, you would need to set your DNS server up with a "split horizon" to give local IP addresses to local computers asking for www.example.com and give the public IP address to everyone else asking for www.example.com.

share|improve this answer
    
By logging in 5 times in 300 seconds with incorrect credentials, we locked ourselves out of the server and blocked our own IP.. Thank you all for your helpfullness. –  Ben Rogmans Jul 12 '11 at 14:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.