2

Today my Ubuntu 17.10 server suddenly lost its ability to connect to its own IP services. It seems to be working perfectly as far as other computers on the network are concerned; for example, other computers can ping it, and they can access the server's web service and make SSH connections to the server.

The server itself, however, cannot even ping its own IP address that other computers can readily access. The server can ping other computers on the network as well as computers outside of the LAN, just not itself. (The server can ping its localhost address though.)

I'm not even sure where to begin to look. The logs are fine, processor load is normal, network activity is normal, and the only piece of software that had been updated within hours before the error appeared is the Google Chrome browser.

The network is setup as follows:

$ ip -4 addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: p4p1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    inet 192.168.2.2/24 brd 192.168.2.255 scope global p4p1
       valid_lft forever preferred_lft forever

$ ip -4 route
default via 192.168.2.254 dev p4p1 onlink 
169.254.0.0/16 dev p4p1 scope link metric 1000 
192.168.2.0/24 dev p4p1 proto kernel scope link src 192.168.2.2 

And,

$ ping -c 1 192.168.2.3
PING 192.168.2.3 (192.168.2.3) 56(84) bytes of data.
64 bytes from 192.168.2.3: icmp_seq=1 ttl=64 time=1.06 ms

--- 192.168.2.3 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.067/1.067/1.067/0.000 ms

but,

$ ping -c 1 192.168.2.2
PING 192.168.2.2 (192.168.2.2) 56(84) bytes of data.

--- 192.168.2.2 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

I haven't been able to Google any answers that discuss a server that cannot ping itself while all other computers seem to be able to access it. Any suggestions?

  • On Linux you can block a server from responding to ICMP echo reply requests by either blocking those in the local firewall or setting the kernel tunable echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all or the equivalent sysctl setting net.ipv4.icmp_echo_ignore_all = 1 - I this case I would stop investigating and try if a simple and quick reboot fixes things – HBruijn Sep 18 '18 at 21:28
  • Yes. I've attempted to both disable the firewall entirely and echoing a 0 to the above-mentioned sysctl setting. Neither work. I'm not sure this is a question about pinging because the server cannot connect to any service (e.g., its own web server) on its own IP address."telnet 192.168.2.2 80" on the server doesn't respond while any other computer can readily access the web site, for example. – Ole Wolf Sep 19 '18 at 5:59
  • 2
    Please don't add Solved to the title of the question. The question will be marked as solved when you accept an answer (you are welcome to accept your own). – Gerald Schneider Sep 19 '18 at 10:45
  • Thanks for the reminder. It seems I'll have to wait another day until I can accept my own answer, though. – Ole Wolf Sep 19 '18 at 10:57
0

The culprit turned out to be sshguard, which uses iptables of its own and wasn't affected when I turned the standard firewall off in order to locate the problem.

I had whitelisted the IP address in sshguard, but the log reveals that apparently it was ignored. (I have narrowed down why the local IP attempted to make SSH connections; it wasn't an attack.) Here's the revealing log entry in /var/log/sshguard:

Sep 18 11:28:13 home sshguard[983]: 192.168.2.2: not blocking (on whitelist)
Sep 18 11:28:13 home sshguard[15315]: Blocking 192.168.2.2 for 240 secs (3 attacks in 121 secs, after 1 abuses over 121 secs)

I'll have to either track down why sshguard ignores the whitelisting or change to another throttling mechanism.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.