1

I have a fresh install of CentOS 4.8 running on an internal development server. I haven't done anything to it besides setting up sudoers and SSH. I can SSH into the server and from there resolve domains to IPs and ping internal servers, but for some reason I don't get any response from pinging external servers.

The software firewall is disabled, and the problem is present with both static and DHCP-assigned network configurations. The network domain controller is a Windows Server 2003 box.

$ nslookup google.com
Server:         10.254.2.5
Address:        10.254.2.5#53

Non-authoritative answer:
Name:   google.com
Address: 74.125.47.147
Name:   google.com
Address: 74.125.47.99
<etc...>

10.254.2.5 is the Win2K3 server.

$ ping google.com
PING google.com (74.125.47.106) 56(84) bytes of data.

It just hangs here indefinitely.

$ cat /etc/resolv.conf
; generated by /sbin/dhclient-script
search <...snip...>.local
nameserver 10.254.2.5
nameserver 10.254.2.124

10.254.2.124 is the backup DC server, which is currently off and tombstoned by this point. The snipped section is our company name.

# ifconfig
eth0      Link encap:Ethernet  HWaddr <snip>
          inet addr:10.254.2.101  Bcast:10.254.2.255  Mask:255.255.255.0
          inet6 addr: <snip>/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:80066 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4421 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:7810133 (7.4 MiB)  TX bytes:590550 (576.7 KiB)
          Interrupt:225 Base address:0xc000

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:32 errors:0 dropped:0 overruns:0 frame:0
          TX packets:32 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:8104 (7.9 KiB)  TX bytes:8104 (7.9 KiB)

# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.254.2.0      0.0.0.0         255.255.255.0   U     0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 eth0
0.0.0.0         10.254.2.5      0.0.0.0         UG    0      0        0 eth0

And, for good measure, a snapshot of the current ethernet config via the system-config-network GUI.

Edit: I don't yet have enough rep to post images, so here's a link. Sorry!
system-config-network snapshot

I'm pretty green when it comes to setting up *nix dev servers and network configuration in general, so please let me know if I've left out critical information, or posted information I shouldn't have posted.

Thanks!

3 Answers 3

1

Nothing requires that ping be possible between two hosts. It might be that somebody between you and google is dropping ICMP packets. If everything else is working I'd not worry much about this.

If you are particularly worried check with whoever runs your networking equipment or firewall and see if they are letting ICMP traffic through. Also check to see if you can ping anybody else in the outside world other than google?

1
  • While all of the Windows workstations seem to be able to access the internet just fine (in spite of the inability to ping and trace route), the development server I started the thread about is a different story. It has all the same symptoms (inability to ping, etc.) but it can't access the outside world via browser, even though it can see, connect to and ping any internal machine and resolve external IPs. We're unable to ping any outside server. At this point I guess it's an issue with our ASA.
    – Beco
    Jul 17, 2010 at 18:35
0

This looks like a routing and/or firewall problem.

How do you connect to the Internet? Is 10.254.2.5 (your default gateway) also your Internet gateway, or do you have other routing in the middle before you can actually reach your perimeter firewall? How is/are your firewall/s configured?

Please post the output of a traceroute -n google.com, so we can see where your packets are actually being blocked.

1
  • Hmm... I guess I'm in over my head. We're a really small web development shop without an IT guy, and our internal network was set up by a third party long ago. All I really know is that we have a router connected to a cable modem, and that connection is split among all of our machines (including the DC) via gigabit switches. # traceroute -n google.com traceroute: Warning: google.com has multiple addresses; using 74.125.67.103 traceroute to google.com (74.125.67.103), 30 hops max, 38 byte packets 1 * * * 2 * * *
    – Beco
    Jul 12, 2010 at 20:05
0

Check your local netfilter rules:

iptables -L -n

If there are no rules affecting ICMP and it is otherwise routing, as it appears to be due to DNS resolution, there is likely some filtering occurring at either 10.254.2.5 or its next hop.

Edit

Based on your update, it looks like you have local firewall rules on the Linux server preventing the ping.

To remove all rules:

iptables -F
iptables -X

They will likely return on reboot. I suspect they are managed by an init script. I'm guessing to disable the init script:

/sbin/chkconfig iptables off

This varies between distributions. I wrote a quick introduction to iptables in a previous answer:

Can you recommend a good intro to iptables?

Typically, simply disabling the firewall is not well advised. However, it does look you are using intranet routable addressing, and your description indicates that you probably already have a firewall further up the route. Be cautious about your actions unless you understand the potential risks of what you are undertaking.

5
  • Running that command results in a long list of rules, with the pertinent one (I believe) being: REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited I assume that is the ICMP rule you were referring to. I guess I need to go learn how to modify iptables rules.
    – Beco
    Jul 12, 2010 at 20:09
  • Please see my edit.
    – Warner
    Jul 12, 2010 at 20:15
  • Hmm, I was able to confirm that the rules had been removed (running iptables -L -n returns a bunch of empty chains now), but even after restarting the network service and rebooting the machine (I also ran /sbin/chkconfig iptables off), I still can't ping external servers. I'm becoming increasingly aware that I'm in way over my head.
    – Beco
    Jul 12, 2010 at 20:31
  • Can the DC with the .2.5 address ping google?
    – Warner
    Jul 12, 2010 at 20:47
  • I was all set to say, "Psh, of course!" but as it turns out, no. It can access Google (and the rest of the internet) via browser seemingly unhindered, but it cannot ping Google (or any other external server). In fact, none of the machines on the local network can, but they can all access the internet via browser.
    – Beco
    Jul 12, 2010 at 21:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .