Some users can't load any websites

[Thomas Jensen]

Hi all

Today the phone started ringing, and then again and again. I have no clue why, but some of my users can't access my websites. They report that the browser just keeps loading forever. I've made one them do a ping, to check DNS, and nothing wrong there.

So far I've restarted apache and clamav, but still facing problems. Some users have no problems at all, and i don't either. The apache log doesn't show anything unusual.

Thanks in advance!

[ivomendonca]

Originally Posted by Thomas Jensen

Hi all

Today the phone started ringing, and then again and again. I have no clue why, but some of my users can't access my websites. They report that the browser just keeps loading forever. I've made one them do a ping, to check DNS, and nothing wrong there.

So far I've restarted apache and clamav, but still facing problems. Some users have no problems at all, and i don't either. The apache log doesn't show anything unusual.

Thanks in advance!

Maybe got banned verify iptables.
Sometimes I have the same problem, from my isp(home) e see all my sites but from other isp dont resolve any domain.

[Thomas Jensen]

Okay.. Can you be more specific? What should i try? It's lots of users..
I've been in contact with one of them, and he had no problem reaching a FTP account.

[ivomendonca]

Originally Posted by Thomas Jensen

Okay.. Can you be more specific? What should i try? It's lots of users..
I've been in contact with one of them, and he had no problem reaching a FTP account.

Cant help you, maybe change mydns to powerdns! i dont realy know maybe a problem in your resolv.conf (ip inside is blacklist)

[Thomas Jensen]

I use an external DNS server, but it isn't the DNS, as one of the users has already tried to make a ping and got the right IP

[damir]

Ask a customer to do a traceroute to your webserver IP.

*nix:

traceroute ip.add.re.ss or domain

Windows:

Start/Run, type cmd and than type:

tracert ip.add.re.ss or domain

Try to visit the sites from different ISP's, it could be a routing problem.

[Thomas Jensen]

Okay, I've done that, but there seems to be no problem at all..

[falko]

Maybe it's a firewall issue? What's the output of

iptables -L

? Do you use fail2ban?

[Thomas Jensen]

The output:

server1:~# iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
fail2ban-ssh tcp -- anywhere anywhere multiport dports ssh
DROP tcp -- anywhere loopback/8
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
DROP all -- BASE-ADDRESS.MCAST.NET/4 anywhere
PUB_IN all -- anywhere anywhere
PUB_IN all -- anywhere anywhere
PUB_IN all -- anywhere anywhere
PUB_IN all -- anywhere anywhere
DROP all -- anywhere anywhere

Chain FORWARD (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
DROP all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
PUB_OUT all -- anywhere anywhere
PUB_OUT all -- anywhere anywhere
PUB_OUT all -- anywhere anywhere
PUB_OUT all -- anywhere anywhere

Chain INT_IN (0 references)
target prot opt source destination
ACCEPT icmp -- anywhere anywhere
DROP all -- anywhere anywhere

Chain INT_OUT (0 references)
target prot opt source destination
ACCEPT icmp -- anywhere anywhere
ACCEPT all -- anywhere anywhere

Chain PAROLE (11 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain PUB_IN (4 references)
target prot opt source destination
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp echo-reply
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp echo-request
PAROLE tcp -- anywhere anywhere tcp dpt:ftp
PAROLE tcp -- anywhere anywhere tcp dpt:ssh
PAROLE tcp -- anywhere anywhere tcp dpt:smtp
PAROLE tcp -- anywhere anywhere tcp dpt:domain
PAROLE tcp -- anywhere anywhere tcp dpt:www
PAROLE tcp -- anywhere anywhere tcp dptop3
PAROLE tcp -- anywhere anywhere tcp dpt:imap2
PAROLE tcp -- anywhere anywhere tcp dpt:https
PAROLE tcp -- anywhere anywhere tcp dpt:mysql
PAROLE tcp -- anywhere anywhere tcp dpt:http-alt
PAROLE tcp -- anywhere anywhere tcp dpt:webmin
ACCEPT udp -- anywhere anywhere udp dpt:domain
DROP icmp -- anywhere anywhere
DROP all -- anywhere anywhere

Chain PUB_OUT (4 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain fail2ban-ssh (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Yes i use fail2ban.

[falko]

Can you switch off your firewall and fail2ban for testing purposes? Do the problems still exist then?