certain IP addresses blocked on one computer

Oops - I selected "accept solution" because I agreed with JefferMC that the technician probably won't help at all. Is there a way to change the status of this back to "unresolved"?

As for traceroutes - here they are.

1. Using mobile hotspot:

sudo /usr/sbin/traceroute --tcp 72.167.1.128

1. 1 htc_frisbee.com (192.168.1.1) 3.144 ms 6.863 ms 6.969 ms
2. 2 172.26.96.161 (172.26.96.161) 108.039 ms 108.710 ms 124.158 ms
3. 3 172.26.96.1 (172.26.96.1) 125.129 ms 125.173 ms 125.185 ms
4. 4 p3nlhg114c1114.shr.prod.phx3.secureserver.net (72.167.1.128) 125.194 ms 125.241 ms 125.257 ms

2. Using ATT router

sudo /usr/sbin/traceroute --tcp 72.167.1.128

1. 1 192.168.1.254 (192.168.1.254) 6.652 ms 7.166 ms 7.198 ms
2. 2 99-189-112-3.lightspeed.sntcca.sbcglobal.net (99.189.112.3) 31.507 ms 31.535 ms 31.537 ms 3 * * *
3. 4 12.83.39.177 (12.83.39.177) 32.681 ms 33.199 ms 33.174 ms
4. 5 gar23.sffca.ip.att.net (12.122.114.5) 35.560 ms 39.362 ms 39.391 ms
5. 6 * * *
6. 7 * * *
7. 8 * * *
8. 9 * * *
9. 10 * * *
10. 11 ae-205-3605.bar2.Tustin1.Level3.net (4.69.158.114) 40.994 ms ae-206-3606.bar2.Tustin1.Level3.net (4.69.158.118) 40.064 ms ae-207-3607.bar2.Tustin1.Level3.net (4.69.158.122) 45.178 ms
11. 12 4.53.182.46 (4.53.182.46) 72.721 ms 74.520 ms 75.584 ms
12. 13 be39.trmc0215-01.ars.mgmt.phx3.gdg (184.168.0.73) 60.971 ms 59.971 ms 60.887 ms
13. 14 be38.trmc0215-01.ars.mgmt.phx3.gdg (184.168.0.69) 60.956 ms be39.trmc0215-01.ars.mgmt.phx3.gdg (184.168.0.73) 60.954 ms 60.903 ms
14. 15 ip-216-69-188-102.ip.secureserver.net (216.69.188.102) 60.958 ms 60.921 ms 47.338 ms
15. 16 lbma1105-17.ars.mgmt.phx3.secureserver.net (50.63.201.246) 46.013 ms 44.707 ms 45.323 ms
16. 17 p3nlhg114c1114.shr.prod.phx3.secureserver.net (72.167.1.128) 45.364 ms 46.459 ms 47.440 ms

The oddest thing is that the problem is so far ONLY with port 80 (http). I haven't tested 443, but am having no problem at all with ftp (21) or ping(1). Clearly traceroute works fine as well. 

Saill

Some more questions/things to try:

• When port 80 doesn't work, what does it do instead?
• Do you have an Internet Security solution that provides a "web safe" feature that blocks access to what it thinks are "unsafe" websites?  
• Have you tried doing a telnet to that IP address on port 80 and 21 from both working and not-working connections and see what the difference is?

Well THAT was a shocker. Excellent technician came out, checked the line, gave me a new RG, and so far so good with those IP addresses.

Totally weird.

Only thing that makes sense is that I didn't manage to do a complete factory reset on the old RG and some scraps of the old firewall were still in place.

It's been about 20 minutes and all is still well.

Fingers crossed that it holds.

Saill

p.s. - thanks for the further suggestions Jeffer. Good ideas. With luck I won't need to explore further.

Ok, this is extremely frustrating. The exact same problem has suddenly cropped up again with the new RG.

Tried setting DNS to Google's and making this machine a DMZ. Absolutely no effect at all.

I am getting extremely angry about this.

Hi @sailll ,

I apologize for the issues you are having accessing certain sites. For some reason it sounds like it may be IP base. When your router gets replaced, usually, you will receive a new WAN IP address. Have you noticed any issues with a telnet connection as JefferMC suggested?

-David T

Hi  @ATTU-verseCare ,

Yes I did get a new IP address with the new router.

I just now tried telnet to the two affected IP addresses. Using the ATT RG I can not establish a connection at either on port 80. Using my mobile hotspot I establish an immediate connection:

With ATT RG:

telnet 72.167.1.128 80

Trying 72.167.1.128... telnet: connect to address 72.167.1.128:

Connection timed out

With mobile hotspot:

saill@linux-mctl:~> telnet 72.167.1.128 80

Trying 72.167.1.128...

Connected to 72.167.1.128. 

**Edited to add**

I have no "websafe" solutions installed anywhere. TCP syncookies is not enabled in my kernel, and at any rate that would not explain why I can connect through my mobile hotspot.

Also, I can immediately connect to port 21 via telne through the RG:

saill@linux-mctl:~> telnet 72.167.1.128 21

Trying 72.167.1.128...

Connected to 72.167.1.128.

Escape character is '^]'.

220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------

**end edit **

As earlier, I have a second Linux computer with an identical configuration which is able to connect to those two IPs via the RG, with no problem.

I am becoming quite convinced that the port 80 connection between this particular machine and those two IP addresses is being explicitly blocked somewhere upstream from  my RG.

About to call ATT again.

This is extremely frustrating. It is preventing me from working.

Saill

Hi @sailll ,

With the second Linux machine, is it connected behind the same U-verse connection. If so, I can only assume that there may be an issue, possibly firewall, that is causing this problem. With the IP blocking that we do, we strictly do it based off the IP and not the MAC address. For testing purposes though, is it possible to put a different network card in that one Linux computer or test with a wireless network adapter?

-David T

---

@sailll wrote:

...

As earlier, I have a second Linux computer with an identical configuration which is able to connect to those two IPs via the RG, with no problem.

...

 

---

I agree with AT&T.  If you have one machine that works and another one that does not, through the same RG, it tells me the issue is inside that machine, not with the RG or further on.  The AT&T network doesn't know the difference between the two machines.

Do you use a different interface when using the hotspot?  If so, then maybe there's some filter on the interface?

Hi @ATTU-verseCare ,

Both machines are connected to the router wirelessly. Unfortunately I don't have a spare wireless card on hand right now.

I will try a wired connection with the machine that is failing to connect. It is my main fast work machine, and I really need it to work.

Saill