Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I recently switched from apache to nginx/php-fpm with a few PHP and Django sites. At some point, some users started reporting that they cannot access the websites and getting "server not found". They say:

I'm trying to open the website from my computer and get "server not found". If I go through other computer at work, or through my phone, everything is fine. My IP is: xxx.xxx.xxx.xxx

I've used grep on error log to find those IP's, but got nothing. It seems, that when user is "blocked" this way he cannot access the website anymore - it is not being cured by itself. On the other side, more than 30,000 people visit the sites every day with no problem.

There seem to be nothing special about those blocked ones - they use different browsers, have different subnets. It does not make sense.

Can you give any advice on how to diagnose and fix this problem?

One of my configs is:

server {
    server_name example.net;
    root /var/www/example/httpdocs;
    index index.php;
    charset utf-8;
    error_log /var/www/example/nginx_error.log;

    # banned users
    include /var/www/example/ban.conf;

    # rewrite rule
    location / {
        if (!-e $request_filename) {
            rewrite ^(.*)$ /index.php?path=$1 last;
        }
    }

    location /admin {
        auth_basic "Restricted";
        auth_basic_user_file  /var/www/example/chronicler/htpasswd;
    }

    # including file with PHP related configuration parameters
    include php_support;
}

ban.conf contents:

deny 178.49.145.133;
deny 109.237.124.172;
deny 95.24.207.110;

IpTables command:

sudo iptables -L -n

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 

UPDATE

The problem was a firewall of my hosting provider. People were blocked and banned for the SYN flood, because my website made them do more than 50 HTTP requests at one go. This is a horrible situation and I had to make optimizations to solve it. Thank you for help, everybody!

share|improve this question
    
Quite vague to help. The first thing you should do is try to reproduce this problem by yourself. –  quanta Oct 27 '11 at 7:37
    
@quanta, That;s the problem - I can't. It seems to affect only random users. –  Temnovit Oct 27 '11 at 7:50
    
what can you tell us about the banned users conf? –  Marcelo Bittencourt Oct 27 '11 at 12:14
    
@Marcelo Bittencourt, it just a list of 3 IPs. I've edited the question. –  Temnovit Oct 27 '11 at 13:58
    
And can you include php_support too? Could be the key. –  SpamapS Oct 31 '11 at 9:10

5 Answers 5

up vote 1 down vote accepted
+100

Do you have any kind of firewall enabled? For example csf has a Port Flood settings sections. Maybe a temporary IP ban because of some kind of network activity from their IP is the reason they receive a "server not found" error.

share|improve this answer
    
This san be true. I've edited the question with output of iptables. Does this tell you something? –  Temnovit Oct 27 '11 at 10:57
    
Nope doesn't seem to be it. –  George Tasioulis Oct 27 '11 at 11:07
    
Your answer made me solve the problem - bounty is yours! –  Temnovit Nov 1 '11 at 15:07
    
w00t! thanks! :) great that you got it solved after all. –  George Tasioulis Nov 1 '11 at 17:01

It really sounds like a DNS service problem, in my practice i haven't seen this problem related to something different than DNS.

Can you give some more information about:

  • are you using your own DNS servers ?
  • if you do, is there any kind of firewall there ? logs showing requests from the problematic clients?
  • ask the client to try 'ping domain.tld' when the problem occurs and see what is the resultt

Also try adding a simple test.html (with just 'Test' in it), and ask the users/clients to try hit this file too (ex. http://domain.tld/test.html). Make sure that the file can be accessed normally, without forcing some redirect.

This way we can try to assure that the problem is not related to some bogus external resources [which affect only certain clients/ip's].

share|improve this answer
    
That's the first thing that came to my mind. Further down there's a comment where he's tired to have the users connect vi IP address same issue. –  Joseph Kern Oct 29 '11 at 15:57
1  
Yes I saw it, but I work with users/clients too, and must tell you that not always users are doing the things you say them (even if they confirm it). For me telling the users to issue ping and then read the IP to you, or sent you a screenshot is more reliable way to be sure they do, what you want them to. I could be wrong, but it's worth to try. –  gryzli Oct 29 '11 at 16:28
    
Good point! Users are always causing some kind of trouble. –  Joseph Kern Oct 29 '11 at 16:44

It's possible it's just general network issues. Are there any geographic similarities between your users that have issues? I'm in Australia, and I had similar issues with my last host through no fault of their own because of networks in the middle. In this case, there's not too much you can really do besides try to get in contact with the network causing issues, but that may or may not do much depending on who they are.

share|improve this answer
    
I don't think so, since this started only when I moved to Nginx - it was ok before. –  Temnovit Oct 27 '11 at 7:10

What about your http{} section in your nginx.conf, any send_timeout set (or anything like that ? Looks like more a network problem than a rewrite or anything like that.

You can try to set these setting a little bit higher:

client_body_timeout   90;
client_header_timeout 90;
keepalive_timeout     90 90;
send_timeout          90;

In the same config file, do you have set things like limit_zone ? This can be problematic with NATed clients.

Can you copy here your nginx.conf ? Another things like tcp_nodelay off and/or tcp_nopush on ?

share|improve this answer

Server not found means DNS resolution failed. Check your DNS. Do you have both www.domain.tld and domain.tld setup? Do the IPs appear in access.log?

share|improve this answer
    
I've asked users to try and access sever via IP address and he got the same result, so I think this is not DNS problem –  Temnovit Oct 23 '11 at 12:59
    
What about the client IP can you find it in access.log? Does the website perform a redirect on connection (like from / to /index.php)? –  korkman Oct 23 '11 at 13:14
    
I don't keep access logs, unfortunaty. I have rewrite mechanism, but if it causes the problem, then why only for a few users? –  Temnovit Oct 27 '11 at 7:13
    
The rewrite rule from nginx is server-side, so can't affect users differently. But there may be redirects from the hosted application. Sniff your traffic with wireshark, look closely at any "Location:" headers sent by the server. Also create a user, re-visit the page with cookies. Create a bookmark with invalid session ID in it, re-visit the page. I guess the application redirects to an invalid domain name for certain cases. –  korkman Oct 28 '11 at 15:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.