Connecting to external website routes to local httpd server

Question

I have this weird issue that started happening a day or two ago, I don't know the cause. The server this is happening on is running CentOS 6.3 64 bit.

For some reason, programs attempting to connect to a webpage of some external webserver instead go to the webserver running on the local machine.

For instance, when I try to "yum update", the repo's give 404 messages, and this is in /var/logs/httpd/access_log:

xx.xx.xx.xx - - [29/Jul/2012:09:18:34 -0700] "GET /centos/6.3/extras/x86_64/repodata/repomd.xml HTTP/1.1" 404 329
xx.xx.xx.xx - - [29/Jul/2012:09:18:35 -0700] "GET /packages/centos/6/x86_64/repodata/repomd.xml HTTP/1.1" 404 317
xx.xx.xx.xx - - [29/Jul/2012:09:18:35 -0700] "GET /repoforge/redhat/el6/en/x86_64/rpmforge/repodata/repomd.xml HTTP/1.1" 404 337
xx.xx.xx.xx - - [29/Jul/2012:09:18:36 -0700] "GET /centos/6.3/updates/x86_64/repodata/repomd.xml HTTP/1.1" 404 336

The xx.xx.xx.xx is one of the ip's on the local machine. It's not just happening with yum, there is another process running on the machine that goes to an external webpage to just signal a heartbeat request, that also gets redirected to the httpd server for whatever reason.

The only thing I could think of was some rule getting added to iptables, I backup up the current rules and then flushed iptables, and the problem still persists. There have also been no recent changes to the httpd configuration or /etc/hosts.

Answer 1

I assume you can ping out from this computer, or else you would have mentioned not being able to.

If you try to telnet out to some site on port 80 and still get your own HTTPD service, I would start looking at things like port forwarding or DNS settings.

If you get the remote host, look for proxies in the Yum service. A forum post elsewhere suggests looking for $http_proxy

Answer 2

It's either DNS, or iptables NAT rules. Check that hostnames resolve correctly with the host command, for example:

$ host google.com
google.com has address 74.125.224.68

If you get an IP in the 127.0.0.0/8 range (or your machine's public IP), then check your DNS server.

To check iptables NAT rules, run iptables -t nat -nvL (note that you don't see NAT rules if you don't specify -t nat). Rules affecting traffic from the local machine would be in the OUTPUT chain. Unless this machine is a router or firewall you probably shouldn't have any rules here.