Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm very confused right now. I have a server, Sahand, that I can connect from on campus too without issue. There's another server, Dena, that shares the same switch, etc.. also can connect to it.

From home though (off campus), I cannot connect to Sahand, but I can to Dena. The server admin assures me that there are no special rules being applied to Sahand. This behaviour is new.

Even when I disable the firewall on Sahand, there is no difference. Last week I was able to connect to it from home, nothing has changed since.

The ufw log (when it's enableD) doesn't indicate that it's blocking.

The traceroutes to both Sahand and Dena are similar.. Not too informative though as my campus blocks ICMP packets.. But when I do a traceroute with TCP packets to some ports, with Dena I can all the way there, with Sahand it can never get there (just enters the campus..)

I'm not sure where to diagnose this issue, as far as I've set it up, both Sahand and Dena should be identical.

Help? Thanks.

share|improve this question
1  
I assume both hosts are on the same public routable subnet? Your description of the TCP traceroutes suggest that there is some firewalling going on outside the server itself. Why would the campus firewall block ICMP but allow full TCP access through the firewall? –  fukawi2 Dec 17 '12 at 23:28
    
Can you get from Dena to Sahand? If they are on the same subnet answering that question could eliminate some variables. –  Keith Stokes Dec 18 '12 at 0:17
    
@fukawi2 Blocking ICMP echo and traceroute from outside the network makes it harder to map the network. Its a fairly common security practice. –  BillThor Dec 18 '12 at 1:09
    
@BillThor I understand that, but that's pretty pointless if you leave the the perimeter firewall wide open for TCP/UDP etc traffic (Pointless anyway IMHO but that's another topic). My point was, if they're "switched on" enough to block ICMP, they probably firewall a lot more, probably in multiple places. The fact that the TCP traceroutes don't reach the destination suggests that also. –  fukawi2 Dec 18 '12 at 3:35
    
@fukawi2 Old habits die hard. TCP and UDP are often open with pinhole rules, which may be the case here. There may be internal firewalls in addition to the border firewall. –  BillThor Dec 18 '12 at 13:47
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.