blaen99

iTrader: (6)

So, I've had various Linux servers running on this network for years. Since several people on here claim to be big Linux geeks, let's see if any of you can come up with things I've missed.

Recently, I've had a previous server running, but between a recent ISP change (A local ISP bought my old ISP out...), plus due to a few other factors (Moving...), my personal server's been down during this ISP change.

Everything is the gorramn same on my network. I've gone so far as to DMZ my Linux server. It's running a stock Ubuntu 12.04 Server install with webmin, LAMP, Java/gcc/g++/make/etc., and Samba.

I can ssh, connect via http/ftp/sftp/whatever perfectly fine if I'm in the local network. But as soon as I do any kind of remote connection, even from computers in the local network to my DynDNS host redirect or even directly connecting to my WAN IP address (Remember, it's DMZ'd, so it should be fine).... I get "connection timed out", as if the thing was behind my router and wasn't DMZ'd/et al'd.

At this point, I'm stumped. iptables even returns a standard setup. I want to start pointing fingers at this new ISP blocking any remote connections or something, because port forwarding doesn't work, virtual servers don't work, DMZ does not work, and it's a stock gorramn Ubuntu install that I just finished installing a little bit ago. Here's the kicker - ping works fine. The server responds to any ping from anything anywhere fine.

Thoughts? I'm freaking stumped after struggling with this most of the day. My hunch is that it is related to some obscure change in 12.04 that I missed/fatfingered or it Really Is just my retarded ISP.

Reverant

iTrader: (10)

Too few details. DSL/Cable? Which router? Do you have a static or dynamic IP? What private subnet are you using? How many eth interfaces on the linux server? A topology diagram would help.

shuiend

iTrader: (24)

What happens if you turn off iptables on the ubuntu server and try to connect?

Reverant

iTrader: (10)

You mean flush the tables and set the default policy to ACCEPT?

shuiend

iTrader: (24)

I mean that would work to. I am just semi lazy and "#service iptables stop" test connection then "#service iptables start" would work. By no means is that the most secure way to do it, but it should work. I also have not spent to much time using Ubuntu as a server. I am mostly a RHEL guy so there might be a few differences.

blaen99

iTrader: (6)

Neither, fiber. Dlink DIR-655V2. Dynamic, hence dynDNS. 192.168.0.* (LAN only network) and 192.168.1.* (WAN-connected network, the Linux server is only hooked up to this). One eth interface.

Topology is basically "Connect Linux server to router. Connect Router to internet".

It is set that way already.

Already tried that. First thing I tried in fact, SHOES!

Thanks guys. Still stumped, I'm baffled and confused. I've been setting up Linux servers for a longer time then most would believe, and Ubuntu from 9.x to 11.10 worked perfect for me. This new server running 12.04 is blowing chunks for me so far though. What baffles me is that the connection is /timing out/ instead of being refused. If I un-DMZ/un-port forward/etc. everything, it just results in connection refused at the router itself.

Saml01

iTrader: (9)

Port forwarding seems like your problem. Are you using a new router or now two routers?

blaen99

iTrader: (6)

I have an Ubuntu 11.10 box acting as a router for my internal (LAN-only) network.

The external (WAN) network is the D-link, the new server shouldn't be affected by the LAN-only network in any way, shape, or form. It is not connected or otherwise touching my internal network. Notable note: Once I get this server working properly, it's replacing the D-link as a router for my WAN network.

I've gone so far as to disable port forwarding and just enable the DMZ, Sam. The second it was DMZ'd, that should have ended any router-specific problems.

Reverant

iTrader: (10)

Traceroute from outside and see where the hops stop.

blaen99

iTrader: (6)

1 75.125.232.57 (75.125.232.57) 0.509 ms 0.642 ms 0.571 ms
2 te1-4.dsr01.hstntx1.networklayer.com (207.218.223.5) 0.583 ms 0.448 ms 0.367 ms
3 po16.dsr02.hstntx2.networklayer.com (70.87.253.105) 0.907 ms 0.783 ms 0.824 ms
4 ae17.bbr02.sr02.hou02.networklayer.com (173.192.18.238) 0.543 ms 0.691 ms 0.532 ms
5 ae3.bbr02.eq01.dal03.networklayer.com (173.192.18.220) 10.407 ms 10.294 ms
6 ae7.bbr02.eq01.dal03.networklayer.com (173.192.18.209) 8.017 ms 8.006 ms 7.887 ms
7 ae1.bbr01.cs01.den01.networklayer.com (173.192.18.139) 22.590 ms 22.541 ms 22.401 ms
8 six.(secret).com (206.81.80.173) 61.656 ms 60.327 ms
9 206.130.137.1.(secret).com (206.130.137.1) 55.700 ms 58.571 ms 57.624 ms
10 CC-3-DHCP-96.46.18.40.(secret).net (96.46.18.40) 61.643 ms 59.321 ms
11 CC-3-DHCP-96.46.18.40.(secret).net (96.46.18.40) 67.827 ms 63.317 ms 58.880 ms
12 CC-3-DHCP-96.46.18.40.(secret).net (96.46.18.40) 59.146 ms * 59.431 ms
13 CC-3-DHCP-96.46.18.40.(secret).net (96.46.18.40) 59.128 ms 67.484 ms 59.139 ms

Nothing drops, it responds correctly to both ping and a traceroute Rev.

Reverant

iTrader: (10)

Does your router have an http interface, and can you connect to it from outside?

blaen99

iTrader: (6)

Yes, Yes if I enable remote management.

Reverant

iTrader: (10)

That means that this particular port is left accessible by your upstream ISP. Shut down the remote management, and setup apache on your server on that particular port. Then setup portforwarding in your router, so that particular port is forwarded to your linux box. Test the apache from inside first, then outside.

shuiend

iTrader: (24)

What does your hosts.allow and hosts.deny files say? Also what does "#ssh -vvv server" tell you when you try to connect?

blaen99

iTrader: (6)

:80, :8080, :8181 are all blocked somewhere outside of my router if I enable remote management and direct it to those ports.

(Edit) I take it back. Inteeeresting, :8181 is not blocked now. Setting up a virtual server on port 8181 to forward to 80 on the new server.

blaen99

iTrader: (6)

Remote management enabled, set to port 80 or 8080: Timed out.

Remote management enabled, port 8181: Connects fine.

Port 8181, set as a virtual server to forward to port 80 on the new server: "Problem Loading Page, unable to connect". No longer timing out.

blaen99

iTrader: (6)

The hosts.allow and hosts.deny are all blank.

ssh -vvv server from a server remote to my network (SSH to remote server, to SSH back to the network) gives a (edit, correction) connection refused error.

Reverant

iTrader: (10)

Timing out is an indication that packages are actively being droped somewhere. Where as a connection denied means that the host is replying that a service ia not setup on the server (unless of course the firewall is configures to REJECT rather than DROP).

Can you connect to 80 from localnet?

blaen99

iTrader: (6)

The server works perfectly if I connect from my 192.168.1.* IPs.

The SQL server, apache, even my gorramn custom-written servers all connect perfectly. If, however, I use 96.46.21.149 to connect instead of 192.168.1.2 it all goes to ****.

Please remember that everything was set up identically two weeks ago and worked perfectly except for A) a new server box running 12.04 instead of 11.10 Ubuntu, and B) An ISP change due to being bought out. My router isn't either option. It hasn't changed since it worked perfectly with my setup 2 weeks ago.

Reverant

iTrader: (10)

I dont know about your router, but on mine if I hit my public IP from the inside, portforwarding works fine. Can you test portforwarding with a production server?