Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a very strange situation on a Linux (CentOS) server.

Firstly, from my Ubuntu desktop PC, I can successfully connect to all services that are running on it, on ports 22, 80, 8080 and others. Ping also works and reports a latency of 20 ms, though it takes longer than 20 ms before it shows that.

Not everywhere though. From several servers around the world:

  • I cannot connect at all to services running on TCP ports like 8080 and 23011.
  • If I wget server.domain.com:80 I get a 403 forbidden, while from my client that also works fine. However, wget server.domain.com:80/somedir works fine.
  • Even ping says "Destination Port Unreachable".

Info:

  • I don't think the location of the server matters; I can't even connect from another server that is in the same building (I think, not sure)
  • The servers that can't connect don't themselves have restrictive firewall or proxies.

I thought it might be something firewally, but this is iptables -L:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination  

Looks empty to me.

I checked whether maybe the other server were somehow connecting to a different server (because of a DNS thing or duplicate IP or something), but that's not the case. The IP is the same everywhere and I can wget a html page that I know to be mine.

What can be up?

(Sorry if there is some information missing. I have root access to this server, but I'm not really its admin. I'm a programmer, not a professional server admin)

share|improve this question
    
403 Forbidden. Sounds like an Apache config/permissions issue, assuming you're using Apache. –  gravyface Aug 5 '11 at 12:50
    
@gravyface Yes, there is an Apache there, but the 403 is not a real problem for me (I probably won't need a HTTPD), rather a symptom of the bigger problem. –  Bart van Heukelom Aug 5 '11 at 13:02
    
Is the rest of the world getting the same IP address for the IP name you are using? –  symcbean Aug 5 '11 at 13:11
    
@symcbean Yes I checked that –  Bart van Heukelom Aug 5 '11 at 13:45
    
iptables -L doesn't show you everything. If iptables-save also shows no rules, then you really don't have any. Remember to check both ends of the connection. Moreover running a traceroute in each direction may provide some valuable information. Use a traceroute version, which can be instructed to perform the trace with the same type of packets, which would generate the port unreachable. –  kasperd Dec 7 at 11:40

4 Answers 4

For the 403 response - check apache's (or whatever web server you are using) config to see if it restricts access based on source IP.

Destination Port Unreachable - this means that ICMP is blocked on the host, most probably by iptables rule.

If it stops earlier, you need to check why the routing does not work.

Also, check all the services running on these various ports, and see if they do not have their own restrictions about which IPs they are accessible from.

It would help, if you post all iptables rules.

share|improve this answer
    
I copy-pasted the error from ping, it really says Port. I can ping the server just fine from my desktop (although it's a bit slow to respond). The services have no restrictions. Some of them I wrote myself, in Java, and they simply do new ServerSocket(port) –  Bart van Heukelom Aug 5 '11 at 13:06
    
This really means that ICMP is forbidden on the host. Check your IP tables. –  Sunny Aug 5 '11 at 13:10
    
Well I can ping from the desktop, and I posted the iptables in the question. Aren't they empty? Sorry, I know nothing about iptables. –  Bart van Heukelom Aug 5 '11 at 13:45
    
how about the firewalls on the other servers. I.e. not their own firewalls, but it could be that they connect to internet trough some restrictive proxy. –  Sunny Aug 5 '11 at 14:13
    
Nope, they don't have those. One of the servers is PayPal's, whose task explicitly is to connect to my server (and others) –  Bart van Heukelom Aug 5 '11 at 14:26

Sounds like a duplicate IP or MAC-address.

  1. If you shut down your service IP - can you still ping the IP from your desktop?
  2. If you ping from within the same VLAN does the arp-cache of the ping-client show the same mac as your server?
share|improve this answer
    
One can also install ipwatchd to detect that. –  Halfgaar Dec 7 at 11:42

Try the files /etc/hosts.allow and/or /etc/hosts.deny The admin might have setup your client to explicit being allowed on every port.

Additionally you said they are services you wrote. do you start them yourself or via something like (x)inetd?

Check if the services listen on all interfaces and not only on one specific interface you use to connect to the services. (Think for example via a VPN link)

you should be able to see your services and the IPs they are listening to with netstat -atulpen

share|improve this answer

For security reasons many services may listen only on the localhost (127.0.0.1 and/or ::1) interface. These services will not be reachable from other servers without tunneling. Check which port are listening on which addresses with the command netstat -ln | sort | less. This will give you a scrollable list of listening services including the IP address they are listening on, and the port.

If your DNS name for the host resolves to your public IP address within your network, it may not be reachable. If you are using NAT, port forwarding, or a DMZ setting on your router to router, then the external (Internet) IP address is being translated to the the local IP address of your server. Many routers cannot, or by default will not route this address from within the local network. This may explain why clients can reach your host, but you can not. Use the command host server.domain.com to determine which IP address DNS is returning. You may also want yo use the command getent hosts server.domain.com to see what the name services return.

You should be able to override the IP address returned for your host by adding an appropriate entry to /etc/hosts. The will be reflected in the results of the getent command, but likely not in the results of the host command.

It is possible you have created a DENY rule for localhost in your apache configuration. If so, you the requests receiving the 403 code will be listed in your servers access log. Such a rule would be unusual, as permission almost always allow localhost, even if they deny access from remote serves.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.