Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

One of my customers of the company I work for has made a change to their Internet connection, and now we can't connect to them any more from our LAN.

To help me troubleshoot this issue, the network guy on the customer's site has configured their firewall so that a HTTPS connection to their public IP address is open to any IP. I should put https://<customer's IP> in my browser and get a web page. Well, it works from any network I've tried (even from my smartphone), just not from my company's LAN.

I thought it may be an issue with our firewall (though I checked its rules and it allows outbound TCP port 443 to anywhere), so I just connected a PC directly to the network connection of our provider, bypassing out firewall completely, and still it didn't work (everything else worked).

So I asked for help to our Internet provider's customer service, and they asked me to do a tracert to our customer's IP. The tracert is successful, as the final hop shown in the output is the host I want to reach. So they said there's no problem. :(

I also tried telnet <customer's IP> 443 and that works as well: I get a blank page with the cursor blinking (I've tried using another random port and that gives me an error message, as it should). Still, from any browser of any PC in my LAN I can't open that URL.

I tried checking the network traffic with Wireshark: I see the packages going through and answers coming back, thought the packets I see passing are far less than they are if I successfully connect to another HTTPS website. See the attached screenshot: I had to blur the IPs, anyway the longer string is my PC's local IP address, the shorter one is the customer's public IP. Screenshot of network traffic as shown by Wireshark

I don't know what else to try. This is the only IP doing this... Any idea what could I try to find a solution to this issue?

Thanks, let me know if you need further details.

Edit: when I say "it doesn't work" I mean: the page doesn't open, the browser keeps loading for a long time and eventually shows an error saying that the page cannot be opened. I'm not in my office now so I can't paste the exact message, but it's the usual message you get when the browser reaches its timeout. When I say "it works", I mean the browser loads and shows a webpage (it's the logon page for the customers' firewall admin interface: so there's the firewall brand's logo and there are fields to enter a user id and a password).

Update 13/09/2012: tried again to connect to the customer's network through our Internet connection without a firewall. This is what I did:

  • Run a Kubuntu 12.04 live distro on a spare laptop;
  • Updated all the packages I could and installed WireShark;
  • Attached it to my LAN and verified that I couldn't open https://<customer's IP>. Verified that the Wireshark trace for this attempt was the same as the one I've already posted;
  • Verified that I could connect to another customer's host using rdesktop (it worked);
  • Tried to rdesktop to <customer's IP>, here's the output:

     kubuntu@kubuntu:/etc$ rdesktop <customer's IP>
     Autoselected keyboard map en-us
     ERROR: recv: Connection reset by peer
    
  • Disconnected the laptop from the LAN;

  • Disconnected the firewall from the Extranet connection, connected the laptop instead. Set its network configuration so that I could access the Internet;
  • Verified that I could connect to other websites in http and https and in RDP to other customers' hosts - it all worked as expected;
  • Verified that I could still traceroute to <customer's IP>: I could;
  • Verified that I still couldn't open https://<customer's IP> (same exact result as before);
  • Checked the WireShark trace for this attempt and noticed a different behaviour: I could see packets going out to the customer's IP, but no replies at all;
  • Tried to run rdesktop again, with a slightly different result:

     kubuntu@kubuntu:/etc/network$ rdesktop <customer's IP>
     Autoselected keyboard map en-us
     ERROR: <customer's IP>: unable to connect
    
  • Finally gave up, put everything back as it was before, turned off the laptop and lost the WireShark traces I had saved. :( I still remember them very well though. :)

Can you get anything out of it? Thank you very much.

Update 12/09/2012 n.2: I followed the suggestion by MadHatter in the comments. From inside the firewall, this is what I get:

user@ubuntu-mantis:~$ openssl s_client -connect <customer's IP>:443
CONNECTED(00000003)

If I now type GET / the output pauses for several seconds and then I get:

write:errno=104

I'm going to try the same, but bypassing the firewall, as soon as I can.

Thanks.

Update 12/09/2012 n.3: So, I think ISA Server is altering the results of my tests... I tried installing Wireshark directly on the firewall and monitoring the packets on the Extranet network card. When the destination is the customer's IP, whatever service I try to connect to (HTTPS, RDP or SAProuter), I can only see outbound packets and no response packets whatsoever from their side.

It looks like ISA Server is "faking" the remote server's replies, that's why I get a connection using telnet or the openSSL client.

This is the wireshark trace from inside our LAN: Inside our LAN

But this is the trace on the Extranet network card: enter image description here

This makes a bit more sense... I'll send this info to the customer's tech and see if he can make anything out of it.

Thanks to all that took the time to read my question and post suggestions. I'll update this post again.

share|improve this question
1  
A description of the problem would be really helpful. All you say is "it works from any network I've tried (even from my smartphone), just not from my company's LAN" and then later "and still it didn't work". This doesn't tell us anything more than that it doesn't work. If you went to a mechanic and said "I tried to drive to work but my car doesn't work", what do you think would be the first thing he'd ask you? What exactly happened when you tried it? Did it hang? Did you get a blank page? Did you get an error message? –  David Schwartz Sep 7 '12 at 17:52
    
Thank you for taking the time to comment. I've updated my post, I hope it's a bit clearer now. –  MacThePenguin Sep 7 '12 at 19:12
1  
Was the capture taken from inside your firewall? If so, can you get one from outside of the firewall? If you look at the capture, packets 12 and 13 are it sending data back to you for streams 1 and 2. You don't send anything back. 20 seconds later, it gives up and sends RSTs. –  Jodie C Sep 7 '12 at 20:30
1  
You say you can telnet to port 443 on the address, but you could go further: try openssl s_client -connect a.b.c.d:443 from some openssl-enabled host on your network (like a linux box), where a.b.c.d is the server's ip address. If it fails on the SSL handshake, you'll know more; if it passes that, type GET / and hit return a couple of times, see if you get some content back. If that fails, you'll know more. –  MadHatter Sep 13 '12 at 12:36
1  
"now we can't connect to them any more from our LAN" ... which kind of service were you connecting to before? Is that a service provided via their firewall itself, or something in their LAN such as an email server, web server, etc? What wireshark results do you get for the attempt to that service you regularly use? –  Skaperen Sep 13 '12 at 12:52
show 4 more comments

2 Answers 2

I would recommend to check your browser's proxy settings..

As you mentioned you've been able to telnet port 443 just fine. And the problme lies within your LAN, so first check the proxy settings of the browser.

share|improve this answer
    
There's no proxy set up on the browser. Also, I've tried different PCs (Windows XP, Windows 7, Ubuntu Linux) and different browsers (Firefox, Internet Explorer) always with the same result. One of the PCs I tried was running a live Kubuntu distro straight from the CD-rom so it didn't have any weird configuration that I could miss or forget about. Our firewall (it's an old ISA server) trasparently caches the webpages that are requested from the LAN, but I've tried bypassing it completely and I still get the same results. Thanks for your suggestion. –  MacThePenguin Sep 7 '12 at 19:16
    
If it worked before, and you changed nothing, and they made all the changes, then it's most likely a problem on their end (or something else happened and their changes were a coincidence in time). It does seem something is throwing out the connection before SSL negotiates (as opposed to a cannot reach). Can you test another port that does not use SSL, such as 80, or if they have a mail server, port 25? –  Skaperen Sep 13 '12 at 12:57
    
@Skaperen Yes it worked before, and I changed nothing, so the error must be on their side not mine: that would have been my reasoning too. But then the tech on the customer's side opened their 443 port to everyone, and I can connect to that service from every network I tried but my company's LAN. This must mean something's wrong somewhere between my firewall and theirs, right? But I can't understand what it is... The other services open on that network for me to try are RDP and SAProuter. They don't work either (see the main post). Thanks for your comments. –  MacThePenguin Sep 13 '12 at 14:45
add comment
up vote 0 down vote accepted

I know you guys are going to hate me... The connection has started working perfectly. I didn't do anything: apparently the firewall on the customer's side has been rebooted and that did the trick.

Again, thank you very much to all of you who took the time to read my question and post suggestions. I've learned a few new tricks thanks to you. I upvoted all of them, I hope I didn't miss any.

share|improve this answer
1  
Yeah, we hate you, if you need that. Now you see why some people just ask if you rebooted. I'm not always keen to reboot a Linux system. But many things sometimes need it, and I've seen cases where even Linux does. –  Skaperen Sep 14 '12 at 2:57
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.