Hi all,

I just signed-up after having successfuly worked with linux for serveral years now. i have experience with linux on both local/desktop installs, as well as managing server-configurations. most of this is with Debian. (stable, unstable)

Up until now i've always managed to work-out any issues without having to ask any questions, undoubtly also with help from solutions i've found here. but now i'm stuck with a mind-boggling issue that i'm unable to solve on my own.

Part of the problem is the fact it takes quite some effort to explain what exactly IS the problem (symptoms), and that it's unclear (to me) where in the networking-topology it could possibly be found. But what also doesn't help is the fact i've always put off 'lower level' networking as much as possible, because it requires substantial amounts of study to know exactly what you're doing. As i hate to do things only half, up until now i've studied enough to use ShoreWall for configuring a firewall, and being failrly confident that it's actually safe. Other than that, my real understanding of netfilter/iptables is fairly thin (and young). The rest of the day, i'm usually focussing on software development for desktop-, mobile and web-applications.

So, as for the problem i'm trying to deal with, i'm hoping to find some support here, in order to narrow down the issue, and possibly finding the cause. I'll try and explain the situation as brief and clear as possible.

The setup is a remote machine, running several services such as web- and mail-server amongst various others, for a numer of different domains.
For this machine i have 6 additional (public) IP-addresses, next to the machines' main ip. These extra addresses are statically routed through the machines main address, and have been bound to 'aliased' or 'virtual' NIC's. (eth0:0, eth0:1 etc..).

This is all working great, already for several years now. The problem that appeared just a few weeks ago is this:

From my office network, I can't connect anymore to the machines' 1st aliased NIC/IP, eth0:0


The very strange thing is that this problem ONLY appears when i'm trying to connect from that particular network, and ONLY trying to connect to that particular address. All other permutations are fine.

Analysing the server logs, i don't see anything special. In fact, nothing at all shows-up in the logs about refused connections or anything.
Analysing the local network, i've found there's virtually no respons from the server when trying to connect. The only respons there appears to be, is that there seems to be a host "but all ports are filtered" when i scan the address with
Another interesting observation, is that when logged-in into the server (through another nic/ip), i also can't connect the other way around to my home network, for instance when i specifically specify the outgoing address like this:

and this is confirmed when scanning the address with nmap, or trying to do the same using telnet on various ports and, while the office-lan is connected using a simple consumer-grade cable-internet connection, without a firewal or anything special.


Another reason why it's so mind boggling to me, is that there hasn't been any changes lately, to any part of either the office-network or the servers' setup. Also, the hosting company/datacenter says there hasn't been any changes, and their system reports that it's working as expected.



Would anyone have any idea what i'm overlooking here?

Thanks for your time!

gr
arri

Hmmm....maybe an update changed shorewall configuration? I would run 'diff' on shorewall config file against your backup config file.

hi sys-fire,

thanks for your thoughts!

however, ofcourse i've gone through the shorewall config over and over again.
but it's a fairly simple setup, and nothing had been changed there..

as shorewall is itsself actually configuring netfilter/iptables etc... i also started studying those in depth.
and although learnig alot, i didn't find what's causing this.

Not surprising thought, since before i had already done all sorts of traffic monitoring (both ends)
while trying to connect, and found that no pachages at all arrive at the remote hosts network.
this is true for connecting in either direction.

and that's where i loose it, because physically this is all about the same two networks, with the same
machines, that are all working just fine...
...except when trying to connect to that one NIC/ip.
...and only my office network has this problem.

because of that fact, it's currently not a HUGE problem, but not understanding what's causing it makes
me very angry

gr
arri

Have you tried changing the IP? Could it be possible that another machine (or local interface) is attempting to share the IP in question? If that's the case, one way to test it would be to change the troublesome IP and then run an arp-scan on that NIC's interface and network (you could nmap as well, but if it's a machine that blocks pings, you may not get conclusive results).

My 2 cents, for what it's worth.