Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a very strange situation on a Linux (CentOS) server.

Firstly, from my Ubuntu desktop PC, I can successfully connect to all services that are running on it, on ports 22, 80, 8080 and others. Ping also works and reports a latency of 20 ms, though it takes longer than 20 ms before it shows that.

Not everywhere though. From several servers around the world:

  • I cannot connect at all to services running on TCP ports like 8080 and 23011.
  • If I wget server.domain.com:80 I get a 403 forbidden, while from my client that also works fine. However, wget server.domain.com:80/somedir works fine.
  • Even ping says "Destination Port Unreachable".

Info:

  • I don't think the location of the server matters; I can't even connect from another server that is in the same building (I think, not sure)
  • The servers that can't connect don't themselves have restrictive firewall or proxies.

I thought it might be something firewally, but this is iptables -L:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination  

Looks empty to me.

I checked whether maybe the other server were somehow connecting to a different server (because of a DNS thing or duplicate IP or something), but that's not the case. The IP is the same everywhere and I can wget a html page that I know to be mine.

What can be up?

(Sorry if there is some information missing. I have root access to this server, but I'm not really its admin. I'm a programmer, not a professional server admin)

share|improve this question
    
403 Forbidden. Sounds like an Apache config/permissions issue, assuming you're using Apache. –  gravyface Aug 5 '11 at 12:50
    
@gravyface Yes, there is an Apache there, but the 403 is not a real problem for me (I probably won't need a HTTPD), rather a symptom of the bigger problem. –  Bart van Heukelom Aug 5 '11 at 13:02
    
Is the rest of the world getting the same IP address for the IP name you are using? –  symcbean Aug 5 '11 at 13:11
    
@symcbean Yes I checked that –  Bart van Heukelom Aug 5 '11 at 13:45

3 Answers 3

For the 403 response - check apache's (or whatever web server you are using) config to see if it restricts access based on source IP.

Destination Port Unreachable - this means that ICMP is blocked on the host, most probably by iptables rule.

If it stops earlier, you need to check why the routing does not work.

Also, check all the services running on these various ports, and see if they do not have their own restrictions about which IPs they are accessible from.

It would help, if you post all iptables rules.

share|improve this answer
    
I copy-pasted the error from ping, it really says Port. I can ping the server just fine from my desktop (although it's a bit slow to respond). The services have no restrictions. Some of them I wrote myself, in Java, and they simply do new ServerSocket(port) –  Bart van Heukelom Aug 5 '11 at 13:06
    
This really means that ICMP is forbidden on the host. Check your IP tables. –  Sunny Aug 5 '11 at 13:10
    
Well I can ping from the desktop, and I posted the iptables in the question. Aren't they empty? Sorry, I know nothing about iptables. –  Bart van Heukelom Aug 5 '11 at 13:45
    
how about the firewalls on the other servers. I.e. not their own firewalls, but it could be that they connect to internet trough some restrictive proxy. –  Sunny Aug 5 '11 at 14:13
    
Nope, they don't have those. One of the servers is PayPal's, whose task explicitly is to connect to my server (and others) –  Bart van Heukelom Aug 5 '11 at 14:26

Sounds like a duplicate IP or MAC-address.

  1. If you shut down your service IP - can you still ping the IP from your desktop?
  2. If you ping from within the same VLAN does the arp-cache of the ping-client show the same mac as your server?
share|improve this answer

Try the files /etc/hosts.allow and/or /etc/hosts.deny The admin might have setup your client to explicit being allowed on every port.

Additionally you said they are services you wrote. do you start them yourself or via something like (x)inetd?

Check if the services listen on all interfaces and not only on one specific interface you use to connect to the services. (Think for example via a VPN link)

you should be able to see your services and the IPs they are listening to with netstat -atulpen

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.