Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a dedicated Windows Server 2008 on which I'm hosting one of my sites. Most of the visitors are able to access the site but some complain that they cannot. Upon digging into the issue, it turns out that when the firewall is disabled, there are no issues at all. But the moment the firewall is turned back on, the same issue surfaces where some of my visitors are unable to access the site (or the server itself - by pinging it or doing a trace route).

Any thoughts how this could be fixed?

share|improve this question
Usually, being able to ping a ip address on the Internet is not related to whether or not you can reach services on that IP address. all you've established by noticing that ping doesn't work is that ping doesn't work. What happens when they try and access your website? What firewall are you talking about? – RobM Oct 10 '12 at 8:24
Hi DJ Pon3. As mentioned, some of the visitors complain about not being able to access the website. The same visitors also forwarded me trace route results showing that they are unable to reach my server. The firewall I'm talking about is the standard Windows Firewall. Any idea what might be blocking some of the visitors while still allowing others to access the site and ping it? – Zishan Oct 10 '12 at 17:53
How close do they get to your server in the tracert? If the tracert isn't getting to your ISP network then it's a routing issue that's out of your control, but you could give your ISP a call and explain the problem and the tracert results. If the tracert makes it to your ISP network then continue investigating from there. Does it make it to your subnet? Does it make it to your router and/or firewall? Does it make it to your server? – joeqwerty Oct 10 '12 at 23:27
The tracert ends right at the perimeter i.e. my data center's router replies back successfully and after that it dies when it's my server's turn. I tried using this utility to verify:, when I disable the firewall, the trace runs fine but the moment I enable it, only few of the listed servers are able to successfully trace route to my server (same goes for the website). – Zishan Oct 11 '12 at 14:40
It does make it to my subnet and router. Probably also does to the firewall but then starts dropping packets for some of the networks. – Zishan Oct 11 '12 at 14:43

Enable dropped packet logging to see if you have a rule configured that may be incorrect. See for step by step directions.

share|improve this answer
Thanks, Mitch - I tried this already but strangely the firewall doesn't seem to be capturing any dropped packets :S – Zishan Oct 11 '12 at 14:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.