Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

if I SSH into my server, and I try to ping another server, I never see the responses. This seems to happen only on urls. I've been able to ping a couple ip addresses.

I first noticed this problem when my PHP cURL requests were failing; I was seeing this error: "name lookup timed out".

Also, I'm not sure if this is unusual, but I couldn't locate nslookup or dig on my server. (doing which nslookup and which dig didn't provide any results)

This problem seemed to coincide with a slice migration (Slicehost was migrating my slice).

Interestingly, I'm able to successfully ping my server from any other computer, and navigate to the webpages it hosts.

My server is: Debian 5.0 (lenny), and I'm running Apache if it makes any difference. I'm a bit of a SysAdmin noob, so please let me know if there's any more info that would be helpful. Any assistance would be appreciated. Thank you!

share|improve this question
    
Also wget fails to resolve the name and I can't do apt-get update or apt-get install dnsutils for the same reason. –  Newtang Feb 13 '12 at 4:25
    
can you post the contents of resolv.conf and hosts? –  Jonathan Henson Feb 13 '12 at 4:32
    
@Jonathan resolve.conf: nameserver 209.20.72.5 nameserver 209.20.72.4 | hosts: 127.0.0.1 localhost localhost.localdomain 127.0.0.1 jnew –  Newtang Feb 13 '12 at 4:35

2 Answers 2

up vote 1 down vote accepted

Newtang,

It sounds like your having DNS resolution issues. To confirm network connectivity you can ping Google's DNS servers 8.8.8.8 or 8.8.4.4. If that works but pinging google.com returns name lookup timed out then it is likely a DNS issue.

/etc/resolv.conf should contain a list of resolvers that your box sends DNS queries. The list should include what your hosting provider recommends. I don't use Slicehost so I can't be certain but this wiki may be of help: http://wiki.slicehost.com/doku.php?id=using_slicehost_nameservers_for_dns_lookups

For testing purposes you can add Google's nameservers to /etc/resolv.conf (at the beginning) and see if that resolves your issue.

e.g.

nameserver 8.8.8.8

EDIT:

If your /etc/resolv.conf looks good then make sure your firewall is not blocking DNS packets. If you're using iptables you can view your rules by running 'iptables -L'. DNS uses port 53 so you will need to make sure that there is a rule allowing the query to go out and another for the answer to return.

Example:

iptables -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp -m udp --sport 53 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --sport 53 -j ACCEPT
share|improve this answer
    
Thanks Vye. My name servers seem to be fine, and I tried 8.8.8.8 and I still had the same problem. I executed your iptables commands, but unfortunately, it didn't help. Any other ideas? Thanks again for the input. –  Newtang Feb 14 '12 at 6:47
    
I ended up flushing my iptables and that did the trick. –  Newtang Feb 14 '12 at 19:31
1  
I recommend adding those commands to your iptables config, not executing them interactively. 1) you will lose custom rules on reboot or iptables restart 2) unless you specify which line the rule should appear on then it may not appear in the right order. iptables will enforce the first matching rule. If a REJECT rule matches before the rules above, the packet will be denied. If you flushed your iptables without editing/reloading the config it is possible your server is now wide open. Does iptables -L list any rules? If it doesn't and the policy is "ACCEPT" then iptables is allowing everything. –  Vye Feb 15 '12 at 4:28
1  
Also, do be careful playing with your firewall remotely. If you make a mistake you could lock yourself out. One trick I usually do is I launch screen and then run './iptables.bsh && sleep 20 && iptables -F'. If the rules loaded successfully then I can press ctrl+c to abort the sleep or if my session was cut I can still log in, resume my screen session and terminate the sleep command. However, if it didn't go well and I got locked out then after 20 seconds the firewall will be turned off, allowing me back into the server. If you're overwhelmed you might consider using ufw to manage iptables. –  Vye Feb 15 '12 at 4:45
    
UFW: help.ubuntu.com/community/UFW –  Vye Feb 15 '12 at 4:46

If it turns out not to be a local firewall issue, check with your hosting provider - I've heard of a couple of hosting providers that block outbound DNS queries and instead force their users to use their local caching nameservers. Generally a bad practice that doesn't happen that often, but it's possible. A quick check with your hosting provider should be enough to verify or eliminate this.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.