1

Just as the title states. The website is not reachable from outside our network, and random computers inside the building timeout for a couple minutes and then are back up.

For the computers inside here, using the IP address gets them access to the site even when using the domain times out.

I've tried calling our DNS provider and they said that the problem lies somewhere in the server, not them. My IT manager tells me that it's not a firewall issue. These both lead me to believe there is something in one of the configuration files that is wrong, but I don't have enough experience with this stuff to play around safely without possibly taking everything down.

Here is some information, if you need to see anything else please just ask..

/etc/network/interfaces:

# The primary network interface
iface eth0 inet static
        address         10.0.1.15
        netmask         255.0.0.0
        broadcast       10.255.255.255
        gateway         10.0.0.1
        network         10.0.0.0

/etc/resolv.conf:

nameserver 10.0.1.3
nameserver 8.8.8.8
nameserver 10.0.1.4
nameserver 8.8.4.4

/etc/hosts:

127.0.0.1       localhost
127.0.1.1       TPSWEB

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
10.0.1.7 git.toolplas.com
10.0.1.15       toolplas.com

Not sure what other information could be useful, and a lot of the stuff in here I'm not sure what it means. So like I said if there's anything else you need just let me know.

Also, something I found weird, when i do wget -qO - icanhazip.com it returns the IP 68.179.41.129. But when I do nslookup new.toolplas.com it returns 68.179.41.131. Not sure if this is related or not..

Also, when I try to SSH in from outside the network I get:

ssh: connect to host new.toolplas.com port 22: No route to host

EDIT:Still reading, trying to gather as much information as possible..

nmap new.toolplas.com

Starting Nmap 5.00 ( http://nmap.org ) at 2015-05-08 13:20 EDT
Interesting ports on toolplas.com (10.0.1.15):
Not shown: 991 closed ports
PORT      STATE SERVICE
21/tcp    open  ftp
22/tcp    open  ssh
80/tcp    open  http
111/tcp   open  rpcbind
139/tcp   open  netbios-ssn
443/tcp   open  https
445/tcp   open  microsoft-ds
8010/tcp  open  xmpp
10000/tcp open  snet-sensor-mgmt

iptables -L -n:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Please, any help would really be appreciated.. Thanks

1
1

10.0.0.0/8 is a private address range, and as such will never be reachable from the outside.

In your nmap, new.tooplas.com resolves to 10.0.1.15, and in another you have 68.179.41.131. So i'm guessing your network topology is as follows:

  • Your LAN uses 10.0.0.0/8 internally
  • Your default gateway (10.0.0.1) has a public IP 68.179.41.129
  • You have a range of available public IPs. Among them, 68.179.41.131 is reserved for your webserver
  • Your ISP routes your whole range to your gateway, which should have a NAT rule to map 68.179.41.131 to 10.0.1.15
  • You are using split DNS so that dns lookups from the inside resolve the private address, and lookups from the outside resolve the public one.

If all this is correct, your random timeouts can be explained by the contents of the resolv.conf, if you have the same configuration on the workstations; queries will randomly hit either your internal DNS servers, or Google's ones. If the nat rules on the gateway are not setup properly, it's possible for the public address not to be available from the outside.

The ssh message no route to host is likely to be caused by the name incorrectly resolving to the private range.

In short, the prime suspects are:

  • The NAT rules on the gateway
  • The DNS settings in your internal desktops
  • The hosts file on the machine you used to test connectivity from the outside

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.