[00:34] I just installed Ubuntu Server 17.10 on a new system, with LAMP & OpenSSH selected for install. [00:34] I ran ufw default settings, and allowed ssh + http [00:35] modified /etc/netplan/01-netcfg.yaml for a static ip setup [00:35] and I am connected, I am able to apt-get update/upgrade [00:36] but I am getting no connection to my server via ssh/http [00:36] the router's port mapping is also correct, wide open to the servers ip address. [00:37] from my point of view, it looks like it should work. Anyone have any insight on this situation for me? [00:39] does netstat or ss show apache listening on the ports and adresses you expect? [00:39] yes, both [00:40] sudo netstat -anp | grep apache && ssh both return LISTEN [00:41] does netcat on localhost work to connect to those services? how about netcat on another host on the LAN? [00:41] although it dosent specify the address, just "tcp6 0 0 :::80 :::* LISTEN 892/apache2" [00:42] does 'nc ::1 80' work? [00:43] I will check [00:43] no error, but it's not returning anything [00:44] and has not returned my command-prompt [00:44] try something like HEAD / and see if you get a nice error reply from your server [00:44] I can't recall enough http by hand.. [00:45] "HEAD /" at the command-prompt? [00:45] in netcat, to your webserver [00:45] ahhhh [00:45] that returned some info [00:46] good good, okay, ssh next :) what address / port is openssh listening on? [00:46] "400 bad request" [00:46] 22 [00:46] and the address? [00:46] local address is 192.168.11.2 [00:47] does netstat or ss output show openssh listening on that address? or on 0.0.0.0? [00:47] 0.0.0.0 [00:48] okay, so something like echo hi | nc localhost 22 ought to spit out the openssh banner [00:49] "SSH-2.0-OpenSSH_7.5p1 Ubuntu-10 Protocol mismatch." [00:50] okay, cool, so the services do seem to be up and working, one reachable via ipv4, one via ipv6... now try from another host on the LAN and make sure that they can be contacted [00:50] aye [00:52] Connection timed out on both [00:52] I will try ipv6 address in web-browser [00:54] that didn't work either. [00:54] connection timed out sounds like a firewall configured to DROP packets; can the testing host contact other hosts on the LAN? on the network? [00:54] yes [00:56] I have a slackware VM that I can connect to, both http & ssh [00:57] networking to VMs is funny.. [00:59] I'm booting it up now [01:00] configuring it's eth0, and I will test it's connection via LAN [01:00] just to be sure [01:02] okay, roger. I am connected to my slackware server at 192.168.11.7, on both ports 80, and 22 (http/ssh) [01:02] from my laptop here [01:04] hey I appreciate your help sarnold, I think maybe I need to make an ubuntu forums post, displaying all these results. [01:05] beatzz: alright; once you get there be sure to inclde the iptables -L output .. I don't know how to drive iptables real well, so that might not be the exact command.. [01:05] just whatever dumps all the rules. [01:07] for sure, hey thanks a lot though [01:07] good luck, have fun :) [01:07] for real, thanks for helpin out :) [01:08] this is my first run with ubuntu * [01:08] tcpdump is good too [01:08] to see if packets are getting there at all [01:08] even if they get dumped [01:08] also you can always add a LOG rule to iptables as last [01:08] to figure out if that's what's happening [01:09] beatzz: ^^ [01:09] aye, I shall [01:09] gana go register at the ubuntu forums [01:11] what for, try the above first :) [01:11] tcpdump returned 109 packets captured [01:11] on port 22? [01:11] 136 packets recieved by filter [01:12] 27 dropped by kerenel [01:12] tcpdump -i $interface port 22 [01:12] kernel* [01:12] run 'tcpdump -i $interface port 22' then go to you client and try to ssh in [01:12] see if anything shows [01:13] roger, client is attempted to connect.... and nothing [01:13] connection timed out on client, tcpdump returns nothing. [01:13] ok [01:14] sudo ufw logging on [01:14] then try again to ssh in [01:15] grep "DST=22" /var/log/syslog after trying to connect/timeout [01:15] if taht shows any output paste on dpaste.com, not here [01:16] it outputs a shit ton [01:16] but the server is on another system, I don't think I can dpaste it [01:16] unless, does ubuntu server have a gui I'm not using? [01:17] [UFW BLOCK] looks disturbing... [01:18] grep "DST=22" /var/log/syslog | head | netcat termbin.com 9999 [01:19] run that on the server and paste the resulting output link [01:20] oh shit, cool trick [01:20] http://termbin.com/nhmj [01:21] all those DST packets look like multicast [01:21] oh, I'm an idiot, lol [01:21] I meant DPT [01:21] no worries, one sec [01:21] grep "DPT=22" /var/log/syslog | head | netcat termbin.com 9999 [01:21] in fact, just in case [01:21] grep "DPT=22 " /var/log/syslog | head | netcat termbin.com 9999 [01:21] note the space [01:22] roger [01:22] it returned with no link? [01:22] ok, so there's nothing, run it without the head/netcat, just the grep [01:22] it should show no output, which means there's no ssh pkts (destinated to port 22) ebing dropped [01:23] aye, again, nothing [01:23] are you running ssh on a weird port? [01:23] no link when there's nothing? that's very handy of them :) [01:23] nope, port 22 [01:23] i have not edited /etc/ssh/ssh_config [01:23] ok, so ufw is not dropping your ssh connections [01:23] and tcpdump is not showing any ssh traffic [01:23] aye [01:23] i will show you ufw status [01:23] so your problem is network, nothing to do with ssh or firewall [01:24] pkts are simply not getting there, maybe swallowed by the VM Host's network interface [01:24] beatzz: do all hosts involved agree on netmask and network addresses? :) [01:24] http://termbin.com/uz65 [01:24] this ubuntu server is not a VM [01:24] yeah like I said I don't think your issue is UFW [01:24] aye, I agree [01:25] so network-ish problem [01:25] so again, what's your network layout? [01:25] what ip/netmask are the client and server on and what's in between them [01:25] I have routers port mapping wide open for both TCP/UDP to 192.168.11.2 [01:25] I have assigned a static IP of 192.168.11.2 to this ubuntu server [01:26] via editing /etc/netplan/01-netcfg.yaml [01:27] on the server, ip addr ls && ip route ls| netcat... [01:27] http://termbin.com/el91 [01:27] paste the link [01:27] ;) [01:27] no, not useful, that's just a config, I want to see reality [01:27] I mean, good to knwo you have that config, but that doesn't necesasrily imply it's being applied/etc [01:27] so do the above pls [01:27] ahh you want ifconfig? [01:28] I want the above, ip addr ls... [01:28] sorry, roger [01:28] nothing to be sorry about [01:29] http://termbin.com/pi6j [01:29] uhm, I guess && doesn't work, that's only iproute [01:29] can you just do ip addr ls | netcat ... pls [01:30] http://termbin.com/3sxw [01:31] and just for reference, here is the full 01-netcfg.yaml : http://termbin.com/7mo4 [01:32] ok, where are you trying to ssh from? [01:32] where's the client? [01:33] and please confirm the server is an ubuntu server 16.04 on baremetal, no VM [01:33] and is that connected with a cable to the router and the router to the internet? [01:34] Ubuntu Server 17.10, not a VM (192.168.11.2) [01:34] and I'm on irc on my laptop (192.168.11.20) [01:34] ok, so both server and client are on the lan, correct? [01:35] Ubuntu server is connected via ethernet cable to router, and laptop wifi, siting with both screens in front ofm e [01:35] yessir [01:35] ok [01:35] please paste ip addr ls and ip route ls from the laptop [01:35] windows :( [01:35] ipconfig /all from cmd, copy paste to dpaste.com [01:36] roger [01:36] ipconfig /all --> http://dpaste.com/0RZQH89 [01:37] how are you running ssh? [01:38] PuTTY on my windows client [01:38] I have a successful ssh connection to my slackware-linux VM at 192.168.11.7 [01:39] via PuTTY [01:39] ok, from cmd, ping 192.168.11.2 [01:39] "request timed out" [01:39] ok [01:40] ping 192.168.11.1 works? [01:40] (it has to, but wth..) [01:41] aye, working [01:41] from the slackware VM, ping 192.168.11.1 , works? [01:41] and then ping .2 [01:42] then from 11.2 ping 11.1 and 11.20 [01:42] SlackVM > 192.168.11.1 working [01:42] SlackVM > Ubuntu Server, not [01:43] Ubuntu > 192.168.11.1, working [01:43] do you have a smartphone? [01:43] Ubuntu > others, not [01:43] yes [01:44] ios/android? [01:44] ios [01:44] https://itunes.apple.com/us/app/termius/id549039908?mt=8 [01:44] install that [01:44] it's free [01:45] installing [01:45] ready to use [01:45] new host... ? [01:45] ok, ssh to ur ubuntu server :) [01:45] yeah [01:45] add 192.168.11.2 [01:45] and connect [01:46] also while you're at it, will come handy: https://itunes.apple.com/us/app/ping-network-utility/id576773404?mt=8 [01:47] attempting to connect [01:48] I'm assuming phone is on wifi on the same router? [01:48] aye [01:48] ok, timed out I assume, if it was working it'd worked by now [01:48] get that ping app, just to confirm [01:49] did [01:49] and try to ping it [01:49] Request time-out [01:49] yeah, fair enough [01:50] do yuo have access to the web interface of the router? [01:50] so strange O_O [01:50] yes [01:50] login, look for tools or something, there should be a diagnostic tab that let you run ping [01:50] find it, ping 192.168.1.2 [01:51] works [01:52] does it have telnet too by any chance? [01:52] negative [01:53] k, np [01:53] can you find a "connected clients" tab on it? [01:53] that shows mac addresses [01:53] it should show your ubuntu server [01:53] mac address [01:53] that, it does not have. [01:53] that's weird [01:53] I've been lookin for that for a few days now. [01:54] i know, but trust me, I've scoured the routers setup, it just dosnt have one [01:54] k [01:54] have you ever used 192.168.11.2 with something else? [01:54] yes [01:55] ok, can you change the ip please to something you've not used before, say 222 ? [01:55] it was the static address of my SlackVM, prior to setting up the ubuntu server [01:55] it is also outside the dhcp block [01:55] I will, my wifes demanding I take the trash out though :/ [01:56] brb [01:56] happy wife happy life, one thing I try hard not to forget [02:00] okay [02:00] so, change the IP address of the ubuntu server [02:01] yep [02:01] then try the ping dance again pls, one host is enough + the router [02:06] okay [02:06] Ubuntu Server is now on 192.168.11.8, dynamically assigned via DHCP [02:07] Laptop(20) ping> Unbuntu, request timed out [02:07] SlackVM(7) ping> Ubuntu, request timed out [02:08] Router(1) ping> Ubuntu, working [02:08] from the phone also no joy? [02:09] I'm kinda wary about the laptop as Vbox can mess up networking [02:09] iphone ping> ubuntu, request time out [02:09] shouldn't, it's configured properly [02:10] * drab scratches head [02:10] Ubuntu server ping> other machines, not working [02:10] Ubuntu server ping> router, working [02:11] im just gana turn off ufw and see what happens [02:11] does phone to laptop work? [02:11] if ufw was a problem blocking pings it'd block the router too [02:12] but sure, try that [02:12] hmmm... Phone ping> laptop, not working [02:12] bingo [02:12] ok [02:12] should have thought of that earlier [02:12] so it has nothing to do with the ubuntu server [02:12] host to host communication on ur network is screwed up [02:12] nodes can talk to the router they are directly connected to, but not to each host [02:13] laptop to VM obviously work because they r on the same physical host [02:13] but I can view my webserver from phone? [02:13] u can? on the slack VM? [02:13] yup [02:13] you might be able to as well [02:13] ah, holy cow [02:13] ok [02:13] http://beatzz.co [02:14] yeah it's up [02:14] right, and from within LAN, I can http://192.168.11.7 [02:14] from the ubuntu box [02:14] telnet 192.168.11.7 80 [02:15] how so? with lynx? [02:15] telnet :) [02:15] "Trying 192.168.11.7..." [02:15] you can basically work through any protocol using telnet if you speak it [02:15] used to send emails with it :P [02:16] argh [02:16] I prefer netcat since it's easy to get out of [02:16] true [02:16] and telnet treats some chars as magic [02:16] but the phone can see http://192.168.11.7 , correct? [02:16] yup [02:16] ubuntu box is not doing anything with telnet [02:17] but cannot ping it? [02:17] ok [02:17] phone -> slack, no ping? [02:17] roger [02:17] phone > slack, no ping [02:18] you're positive yuo did telnet 192.168.11.7 80 yes? including the 80 at the end [02:18] yessir [02:18] * drab scratches head [02:18] if finally returned something too [02:19] "telnet: Unable to connect to remote host: Connection timed out" [02:19] right, np [02:19] so basically, host > host, no ping [02:20] only thing that returns a ping, is host > router [02:20] and router > host [02:20] if the phone couldn't get to the webserver I'd thought the router somehow was isolating the nodes [02:20] but since it can, that can't be true [02:21] are you running a firewall of sort on slack or blocking ipngs on win? [02:21] can the phone ping the laptop? [02:21] < beatzz> hmmm... Phone ping> laptop, not working [02:21] nope [02:21] no host > host ping [02:22] did you double-check the netmask and IPs on all the hosts? [02:23] sarnold: but phone > slack http works [02:23] that's what is so damn weird [02:23] but windows can block pings [02:23] and ssh [02:23] so the ping not working may be ok [02:24] .. and VM networking software sometimes only ever works for TCP and UDP and drops everything else on the floor [02:24] on the phone you put "http://192.168.11.7" in your browser? [02:24] yeah, or just the IP works as well. [02:24] sarnold: true, but telnet 192.168.11.7 80 doesn't work, which is tcp [02:25] what's ip route ls and ip addr ls on the slack VM? [02:27] and how is virtual box network configured? bridge mode? [02:27] ip route ls --> 127.0.0.0/8 dev lo scope link 192.168.11.0/24 dev eth0 proto kernel scope link src 192.168.11.7 metric 202 [02:27] bridged, yes [02:30] sudo tcpdump -i lxdbr0 icmp on the ubuntu server [02:30] ping it from the phone [02:30] and from the router [02:30] lxdbr0? [02:30] eer, sorry [02:30] that was my test [02:30] -i whatever your interface [02:30] that's what that smelled like :) hehe [02:33] phones ping utility shows request time-out [02:33] tcpdump shows nothing [02:33] which means the ping request is getting blocked at the router [02:33] aye? [02:34] which makes sense, why we cant ping host > host [02:34] if you ping from the router do you see the pings? [02:34] yes, router > host works [02:34] on all hosts [02:34] but yes, it feels like somehow traffic is dying at the router... no idea why [02:35] ufw is stopped? [02:35] sudo iptables -L -v , shows no rules all ACCEPT? [02:35] on the ubuntu server [02:36] sometimes routers have buttons to prevent wifi segments frmo communicating with wired segments [02:37] oh, good call sarnold [02:38] beatzz: check that, will ya? [02:38] or otherwise, plug the ethernet cable straight into ur laptop if you have a port [02:39] and try that, I was gonna suggest that anyway because I'm out of guesses... [02:39] aye, me too [02:39] i think we've beat this horse to death [02:39] poor horse [02:39] gana give it a rest [02:40] thanks for the support drab & sarnold [02:40] wait, last test! [02:40] check the router :P [02:40] what model is it? [02:40] ummm... [02:40] buffalo WZR-300HP [02:41] https://superuser.com/questions/856499/buffalo-wzr-1750dhp-cant-reach-the-lan-side-using-wireless [02:41] According to the manual that router supports SSID and Wireless Client isolation [02:41] :........( [02:42] sarnold wins [02:42] maybe [02:42] so wait, okay [02:42] if thats the case [02:42] I should be able to access the http server from another network [02:42] http/ssh on the Ubuntu server [02:42] altho that's not quet what it says, it says wireless client isolation, not to lan [02:42] from outside my network [02:42] yes [02:43] if you put it back on 2 / the port forwarding on the router matches [02:43] port forwarding goes to 8 [02:43] its currently open [02:44] doesn't seem to be quite it actually [02:44] If enabled, the Wireless client isolation blocks communication between wireless devices [02:44] connected to the AirStation. Wireless devices will be able to connect to the Internet [02:44] but not with each other. Devices that are connected to the AirStation with wired [02:44] connections will still be able to connect to wireless devices normally [02:45] what about connections from wireless to wired? o_O [02:45] didn't work [02:45] omfg [02:45] no ping from laptop to ub or phone to ub [02:45] it works [02:45] you should be connecting to it as well [02:45] ok, so sarnold wins somehow still [02:45] from http://beatzz.co [02:45] hahaha [02:46] beatzz: apache default page! \o/ [02:46] refresh ur browser, and it will show the ubuntu [02:46] holy nuts [02:46] ever watched office space? [02:46] printer scene [02:46] yeah [02:46] to the buffalo router [02:46] it's almost xmas, get urself another router... le sigh [02:46] damn [02:47] i was just starting to smell smoke coming out of my ears a minute ago [02:47] like, wth, everything is correct [02:48] ok, this is a good time to quit, I'm out [02:48] gnight drab :) [02:48] thanks so much man [02:48] like I said the other day, trust in sarnold, ignore everybody else [02:49] ttyl === JanC_ is now known as JanC === JanC_ is now known as JanC === JanC_ is now known as JanC === JanC is now known as Guest67213 === JanC__ is now known as JanC === JanC__ is now known as JanC [06:28] just another shout out to drab and sarnold ! Server's up and running, nice and safe behind firewalls and stuff. http://www.beatzz.co [06:29] now get your free ssl certificate :-) [07:13] cpaelzer: xnox: yes we enable nested by default on e.g. intel as smb pointed out [07:14] cpaelzer: I wanted to drop that (an admin can still opt in at any time) but I see that this might be too much of a churn for all of the consumers of qemu [07:14] xnox: smb: on s390x yeah - I don't vote to make it nestes=1 by default (as it isn't atm), but users should be able to switch it on [07:15] smb: did I get you right that due to not being a module you can't set the value to 1 ? [07:16] Good morning [07:16] hi lordievader [07:17] Hey chamar (IRC) [07:17] cpaelzer (IRC)* [07:17] How are you doing? [07:18] oh I got an asterisk :-) [07:18] doing good [07:18] skipped the disturbing mails for now :-) [07:18] Hahaha [07:18] Nice [07:32] Hello [07:33] Do you know of any bash scripts someone might have written to quicky deploy services, setup services, etc, on newly created ubuntu server instances or installs? [07:38] I use puppet for such things. [07:38]