Teacher
•
32 Messages
certain IP addresses blocked on one computer
Hi,
I thought I was having the same problem as GregDO, but it appears mine is different, as my IP address does not start with 172.
I can connect to everything via my ATT router except websites on both my GoDaddy hosting accounts.
Earlier I had remedied this by switching to Google's DNS server at 8.8.8. That worked for several weeks but stopped working yesterday. I also tried changing my router to make my main work machine a DMZ, also to no avail.
This morning I tried a factory reset on my router, after which I had access to websites on these two IP addresses for about 15 minutes before they were blocked again.
I can connect to these addresses with no problem when I am using my mobile hotspot.
I can also connect using a different computer with identical settings.
I interact with these IP addresses heavily, as I am a web developer. I suspect that they are being blocked by some kind of firewall, either on the router or upstream at ATT.
Because the problem reappeared shortly after I reset the router, I am concerned that the problem may lie upstream from it - i.e. ATT is assuming some sort of exploit is occurring and is explicitly blocking traffic between the mac address of the affected computer and the two IP addresses that I most want to connect to.
I have a technician coming out to look at the problem this afternoon, but am worried that he or she will not be able to resolve the situation.
I'm wondering if anyone in the community has insight into this problem.
Saill
sailll
Teacher
•
32 Messages
10 years ago
Hi @ATTU-verseCare and @JefferMC ,
I have figured out the proximal cause of my problem, and a simple temporary workaround, although the root cause is still a bit of a mystery to me. Here is a detailed description of my discovery this weekend:
1. Background
I have two devices with http connection capabilities connected to my RG - my "fast" Linux machine and my "portable" Linux machine. Once a day and whenever I go out for a meeting or some cafe-time, I rsync the the fast machine's data to the portable machine. When I return home, I rsync the portable machine's data to the fast machine.
For convenience, when I am in my home office the normal state of the system is that both machines are on and networked into the RG. Both machines typically have both Firefox and Chrome up, with a dozen or so tabs open, each. At least half of these browser instances are connections to my two GoDaddy shared hosting IP addresses, as I am a web developer working on a number of projects simultaneously.
As reported earlier, I have recently started having trouble connecting to these two IP addresses on my "fast" machine, to the extent that I have lately been completely blocked from accessing them.
2. Accidental Discovery
This weekend I left home for a while with the portable machine. When I left, the fast machine was in its normal state of being unable to connect to the two GoDaddy IP addresses via the RG.
When I got home I turned on the fast machine, opened Chrome and, just as a test, navigated to urls on both the problematic IP addresses. To my surprise, they opened without a problem. I figured this grace period would last 10-15 minutes as it has in the past, so I decided to time it. Twenty minutes later, all was still well. A small lightbulb started to glow gently in the back of my mind.
I then plugged in and turned on the portable machine. As it started up I turned off its networking and closed its browsers. I then checked the fast machine, and found that its connection to the two GoDaddy IP addresses was still good.
I then connected the portable machine to the RG, with its browsers still closed, and started an rsync. Checked the fast machine and all was still well.
Finally, I opened Chrome on the portable machine. On the portable machine, Chrome defaults to its previous state, which is dozens of tabs, many of which are connected to the problematic IP addresses.
I checked the fast machine, and indeed, it could no longer connect to those IP addresses.
3. Further Research
I then went to the portable machine and closed Chrome, and went back to the fast machine. Instant connection.
I decided to work with just one of the IP addresses. I opened an associated URL on the portable machine - one that I know to contain very simple, fast-loading html. I set my stopwatch when the site loaded on the portable machine, then moved to the fast machine and loaded the same URL there.
The fast machine was unable to open the same URL for nearly two minutes. After that it could connect.
Further testing and timing showed that the delay for the fast machine to connect to a URL that had been opened on the portable machine was between 1:37 and 2:45 minutes. This seems to approximately correlate with the amount of time that the TCP connection on the portable machine is in the "Established" or "Time Wait" state.
4. More Information
At this point I started to think more about my normal http connection habits. As I mentioned, I often have at least a dozen connections to the two problematic IP addresses open. As I most often develop both websites and plugins in WordPress, many of these connections are to the WordPress dashboard, which periodically refreshes itself to check for updates. I also use a WordPress site traffic monitor which refreshes every minute, in some views, in order to provide a current snapshot of visitors. Finally, some of my sites on those IP addresses include JavaScript animations that periodically reload the page in order to restart the animation.
Given all this, there is a high likelihood that in its normal resting mode, the portable machine is making http requests to one of the problematic IP addresses more than once a minute.
And, indeed. When I point a browser on the portable machine to one of the urls that automatically sends http requests to one of the problematic IP addresses, urls on that IP address become continuously blocked on the fast machine.
5. Even Further Research
a. The effect is not reversible. The fast machine's connections have no effect on the portable machine's ability to connect.
b. The effect does not (so far) occur with other gateways. When both machines are connected to the internet via my mobile hotspot, they do not interfere with each other at all. Similarly, when my portable machine was connected to the internet via Comcast cable with a Linksys e1200 router, my portable macine and several Windows machines were able to simultaneouly and immediately connect to one of the urls on a problematic GoDaddy IP address.
6. Conclusion
Because there is a simple workaround to my problem, which is to close the browers on my portable machine when it is connected to my home network, I no longer feel so much urgency about this issue.
Nonetheless, I do not believe that this is normal or acceptable gateway behavior. I am curious about whether this is related to my unusual behavior related to running Linux machines and to having multiple simultaneous connections from several devices to the same IP address.
I occasionally train clients on the use of their WordPress dashboard in my home office. This problem, which makes it impossible to have two computers connected simultaneously to the same URL on my home network, will make that kind of training impossible.
Finally, I have not cancelled tomorrow's appointment with the ATT technician. I would like him to see, understand, and document the problem I am having so at the very least he can assist others who might be experiencing something similar.
Again, thanks for all your help and attention to this problem.
Saill
0
0
JefferMC
ACE - Expert
•
35.6K Messages
10 years ago
Can you find the page on your RG where it shows the number of NAT sessions in use?
On my 3800, it's found under Settings > Diagnostics > NAT:
0
0
sailll
Teacher
•
32 Messages
10 years ago
@JefferMC - checking for that.
Ok - found it. Can easily cut and paste it. Any suggestion for a test to perform?
Saill
0
0
JefferMC
ACE - Expert
•
35.6K Messages
10 years ago
Looking to see if when you're experiencing your issues, has the NAT table been exhausted.
0
0
sailll
Teacher
•
32 Messages
10 years ago
Ok - I closed all tabs on the portable machine (NAT = 192.168.1.65) except the one that's refreshing its connection to the IP address 72.162.1.128 once a minute. A connection to the same URL on the fast machine (NAT = 192.168.1.64) will not load. I have only that URL and the ATT forum URL open on the fast machine. A tail of the RG NAT page shows mainly connections to the ATT page, with a few attempts to connect to 72.162.1.128 by the 192.168.1.64 machine, which resulted in SYN_SENT state. This matches what netstat -nat tells me on the fast machine.
0
0
sailll
Teacher
•
32 Messages
10 years ago
Hi @JefferMC
Tried to cut and past the RG's NAT diagnostics page, but the forum wouldn't accept so many characters. In a nutshell... Closed all connections on the portable machine (192.168.1.65), except the one to 72.167.1.128 that reconnects once a minute. Closed all connections on the fast machine (192.168.1.64) except the one to the same URL (which will not load) and the one to this forum. When I attempt to refresh the problematic page on 192.168.1.64, the following shows up on the RG NAT diagnostics page, mixed in with a preponderance of connections to the ATT IP address. It shows the connection to the 72.167... IP address to be in the SYN-SENT state on the .64 machine, which matches its netstat -nat results that I see.
(forum seems to be blocking copy/paste from RG page. Let's see if this gets through...)
Saill
0
0
sailll
Teacher
•
32 Messages
10 years ago
Ok -got that through. Here is what NATdiagnostics says:
0
0
JefferMC
ACE - Expert
•
35.6K Messages
10 years ago
Honestly, I was hoping for the table summary like the one I pasted, to get an idea if the translation table is overflowing. I'm not seeing anything in these entries, but this is just a small subset. The Protocol 17, port 53 requests to 8.8.8.8 are DNS requests to Google. The Protocol 6, port 80 requests are obviously requests to your Web server.
0
0
sailll
Teacher
•
32 Messages
10 years ago
Hi @JefferMC - Oops - missed the little table you posted. Here is mine, in the state of one machine connected and refreshing, and the other machine unable to load the page:
0
0
JefferMC
ACE - Expert
•
35.6K Messages
10 years ago
For some reason your original post just filled in the long log and the table was at the top of it as well. Well, NAT session overload is not the answer. Sigh. Scratching head thinking of other possibilities.
0
0