Google and services problems: timeout and filtered packets

hknoener · 03-07-2012, 07:14 PM

Hi.

I already tried to look for it over the internet and didn't find the answer yet. So, please, if you think the answer was already posted somewhere, give me some hints to find it because I was not able to.

I use CentOS 6 on my server. Basically it is a DHCP and Internet server. I have Squid running (3.1.4) with some rules on my Iptables to block P2P ports.

For the last 2 months or so I'm experiencing some problems. The strange thing is that it appears to be only related to Google websites and services. The last 3-4 weeks this problem got worse.

Almost every morning I need to restart my network services with a different IP for my WAN Ethernet to fix the internet stability. Often I have timeout problems with Google websites. Some days ago it just stopped working with my Squid. Without Squid it worked fine, but not with Squid. Then I added Google DNS to my resolv.conf and solved for a while.

Now the things get even worse this morning. Any Google service that requires login isn't working. If I try to ping accounts.google.com, for instance, it gives me this feedback:

Code:

From nta-ip-117.103.91.50.dynamic.ntamar.net (117.103.91.50) icmp_seq=1 Packet filtered

If I try traceroute, there's the result:

Code:

traceroute to accounts.google.com (173.194.79.84), 30 hops max, 60 byte packets
 1  nta-ip-117.103.91.50.dynamic.ntamar.net (117.103.91.50)  1297.269 ms !X * *

If I try to ping www.gmail.com it goes through without problems. Traceroute the same. If I try to browse www.gmail.com it doesn't load. If I try to go to google website, it opens. If I try to login, it doesn't.

Already tried to add/remove Google DNS from resolv.conf, use Squid and connect straight without it, tried to flush my iptables, and so on.

My internet provider here sucks, but getting to block Google services I don't think so. Anyway, something happens with Google websites since long time already and I still have problems figuring out what. Of course, using web proxies (zend2, for example) it loads normally.

An I being stupid or my provider is playing with me?

elfenlied · 03-07-2012, 09:50 PM

Hard to tell where the problem is at the moment, it could be iptables, dns, squid or even network related. Are you seeing any information in your /var/log/messages or you squid log ?

Do dns lookups works all the time?

hknoener · 03-07-2012, 10:36 PM

Elfenlied, can you explain me how this could be a problem with my server? My iptables were empty already, DNS service stopped, and squid stopped. I was even using Google DNS and nothing.

I'm trying to believe that's a problem with MY server so I can fix it, but it has been difficult to understand how it could be. Now, after the entire morning and part of the afternoon Google services just started working again like nothing was happening. I didn't change a thing, everything was running like usual, none of Squid ACL's are schedule to stop by that time and still it came up again.

The message that I got from the server, using a text browser (Links) what "no route to host".

NOW if I ping accounts.google.com it answers normally. Traceroute the same. I really don't think it's a server problem, but I can be wrong.

---------- Post added 03-08-12 at 04:37 PM ----------

Elfenlied, can you explain me how this could be a problem with my server? My iptables were empty already, DNS service stopped, and squid stopped. I was even using Google DNS and nothing.

I'm trying to believe that's a problem with MY server so I can fix it, but it has been difficult to understand how it could be. Now, after the entire morning and part of the afternoon Google services just started working again like nothing was happening. I didn't change a thing, everything was running like usual, none of Squid ACL's are schedule to stop by that time and still it came up again.

The message that I got from the server, using a text browser (Links) what "no route to host".

NOW if I ping accounts.google.com it answers normally. Traceroute the same. I really don't think it's a server problem, but I can be wrong.

elfenlied · 03-07-2012, 11:19 PM

So what dns servers are you using in your /etc/resolv.conf? From memory google ones are 8.8.8.8 and 8.8.4.4 (not sure if there are more).

The "packet filtered" in your icmp request just means that that particular host could be configured to drop icmp replies. Since you say the issue is just related to google services.

I did a whois on your first hop (nta-ip-117.103.91.50.dynamic.ntamar.net (117.103.91.50)) and I'm guessing you're based in the Marshal Islands so there is a possibility that it could be your ISP (seeing its a fairly remote location, ie kind of between Australia & Hawaii).

Although it doesn't happen to often for us here but there was a time last here where there were issues with one of the major providers here in Australia and access to any US site was either dreadfully slow or didn't work at all. Have you contacted your ISP? It's just a guess but it wouldn't hurt to verify, the other sites you generally access are they local or US based as well?

hknoener · 03-09-2012, 02:58 AM

Sorry for the delay.

One of my students told me that (don't whether is true) NTA, Internet provider for this Island, lost their fiber optic connection to Guam due to debts problem. Meaning the only possible connection to the World, now, is even more compromised.

Yes, you're right, I'm using one of those DNSs (8.8.8.8).

You are correct again. I'm currently in Marhsall Islands. About our service provider I don't even think about calling them again. Last fight that I had with them was a 2-month long fight and resulted in no more answering by the end since they had no more replies to my questions about their crappy service.

So in your case it could not happen too often but, unfortunately, it's not my (our) case here. Websites that I access are ALL located elsewhere. Here they don't even have local websites.

hknoener · 03-17-2012, 03:30 AM

Is there a way to cryptography the connection somehow that my ISP is not able to check my traffic?

I can't find any other way to workaround this issue. Unless I can pass through my ISP without any blocking on their side I'll not be able to use my services here decently.

The service has been so inconstant that I can't even rely on using Gmail and any other Google related services, cause they just stop working out of the blue several times a day. Some other websites as well I just can't connect unless I use some proxy (like Zend2, etc).

So unless you guys give me another choice, the only answer that I can see is to crypto my connection to clear my pass throughout my ISP.

Is my thought correct or this will not solve the problem?

elfenlied · 03-17-2012, 03:44 AM

The easiest solution would be to possibly use an SSL proxy server, that way all they see is you accessing the proxy server and not that you're accessing google services via that server.

hknoener · 03-17-2012, 03:49 AM

How would I do that?

elfenlied · 03-17-2012, 03:53 AM

Try some of these http://proxy.org/cgi_proxies.shtml

hknoener · 03-17-2012, 07:23 AM

Coincidence or not I'm not able to access this website here. Even using other websites to open Proxy.org didn't work. For all the Google services it says "no route to host", using or not the squid proxy.

But this solution is not intended to be used straight into the internet server, is it? I know that I can use it for normal browsing, from my browser, but is there a way to do that directly from my internet server?

Update:
Let me share my WAN and LAN IP here just to check if anything is wrong or misplaced. I've connected the modem straight to my computer and Google and services worked fine. So something is creating a conflict on my network.
WAN Setup - Eth0 (Static, provided by ISP)
IP: 192.168.170.49
Netmask: 255.255.255.0
Gateway: 192.168.170.254
DNS1: 117.103.88.33
DNS2: 71.163.249.97

LAN Setup - Eth1
IP: 192.168.1.1
Netmask: 255.255.255.0
Gateway: 192.168.1.1
DNS1: 117.103.88.33
DNS2: 71.163.249.97

Is there any problem using the same Netmask for both interfaces? Do I need to use DNSMasq on the eth1 (I'm using it right now)?
Maybe I'm just being dumb and creating a network conflict.

hknoener · 03-26-2012, 04:17 PM

I have set up my entire server again, from the scratch. Now it's working a lot better. I still have some problems to solve, but at least Google and Co. appears to be working fine for now. Websites still take too long to respond, but I think my DNS, combined with my connection here, suck.

hknoener · 03-28-2012, 05:44 AM

Ok, right now I'm facing the same problems as before.

If I try to ping, for example, accounts.google.com I get the following answer:

Code:

PING accounts.l.google.com (173.194.77.84) 56(84) bytes of data.
From nta-ip-117.103.91.50.dynamic.ntamar.net (117.103.91.50) icmp_seq=8 Packet filtered
From nta-ip-117.103.91.50.dynamic.ntamar.net (117.103.91.50) icmp_seq=10 Packet filtered
From nta-ip-117.103.91.50.dynamic.ntamar.net (117.103.91.50) icmp_seq=11 Packet filtered
From nta-ip-117.103.91.50.dynamic.ntamar.net (117.103.91.50) icmp_seq=16 Packet filtered

If I issue a Traceroute to the same website, the problem is very similar:

Code:

traceroute to accounts.google.com (173.194.77.84), 30 hops max, 60 byte packets
 1  * * *
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * nta-ip-117.103.91.50.dynamic.ntamar.net (117.103.91.50)  37.195 ms !X *

Can somebody tell me what is the meaning of this? I mean, am I right to say that there's a problem with my ISP?

This kind of situation is random, there's nothing changing that could explain this. In a minute everything is working and in the next is stops. Sometimes even the google search engine stops working.

Any help will be very appreciated!