0

I am trying to setup a build server on AWS Windows Server 2012 R2 x64 base image. The server however is unable to connect to www.nuget.org to retrieve the packages for the build (and cannot access some other websites). I can nslookup and retrieve an IP address and the server allows ALL OUTBOUND traffic (AWS SG).

I have tried adding ALL INBOUND traffic, turning off the server's firewall, and even turning IE security all the way down to see if the connection can be made. All this together, it still did not work. I have a linux machine in the same VPC that I could use lynx to load nuget.org.

Setup:

  • Windows Server 2012 R2 x64 base
  • Elastic IP on public subnet interface
  • All Outbound traffic allowed

Am I missing a security measure in Windows Server that needs to be modified?

Side notes:

Could Access:

  • google.com
  • youtube.com
  • bing.com
  • facebook.com

Could not access:

  • stackoverflow.com
  • nuget.org
  • serverfault.com

Personal computer DNS Lookup:

Non-authoritative answer:
Name:    nuget-prod-0-v2gallery.cloudapp.net
Address:  168.62.110.126
Aliases:  www.nuget.org
          nuget-prod-v2gallery.trafficmanager.net

Server DNS Lookup:

Non-authoritative answer:
Name:    nuget-prod-0-v2gallery.cloudapp.net
Address:  168.62.110.126
Aliases:  www.nuget.org
          nuget-prod-v2gallery.trafficmanager.net

UPDATE

The server has two network interfaces, one on the public subnet and one on the private. When I disable the private subnet network adapter within windows, I can load nuget.org. When it is enabled, I cannot. Shouldn't I be able to since the public adapter has internet access? The private subnet only has the VPC network route in the route table.

  • Huh. So you can access things owned by Google and Microsoft, but not other sites. Could it be DNS? – Katherine Villyard Jan 6 '15 at 2:45
  • I'd check DNS name resolution as a first step. – joeqwerty Jan 6 '15 at 2:51
  • 1
    @KatherineVillyard Doesn't add up. The problematic one is clearly on Windows Azure! – Michael Hampton Jan 6 '15 at 3:01
  • Nslookup seems to return the correct result for www.nuget.org. What happens exactly when you try to access those sites? – joeqwerty Jan 6 '15 at 3:06
  • @joeqwerty IE reports the page cannot be displayed. I installed chrome to test and it reports a connection timeout. The server is not behind a proxy either. – UnholyRanger Jan 6 '15 at 3:10
0

When you have two interfaces on Amazon EC2, each in a separate subnet, you'll end up having two gateways configured for each network card and this will cause some erratic issues with network traffic routing. You'll see this is a common issue via your Google fu. (For e.g. here)

To Fix:

  1. The private NIC receives a dynamic ip address from Amazon. Use this IP address and assign it statically to that interface.
  2. Remove the default gateway from the private NIC and keep a note of the gateway IP
  3. Create a static route to this network using "route -p add " via the gateway IP you noted in (2).

If you let me know you're subnets, I could provide you with the exact commands to type but hope this gives you a good starting point.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.