Hello all,
Looking for some direction on a weird problem I am having with one particular client on my server.

The client only just recently cannot access their domain or any others on my server, from any computer within their office using their Cable modem with Cox Communications, however, they can access it if they use their old AOL dialup account. They've had no problems until just recently.

I can hit their domain from several networks outside of them no problem.

Cox says their is no problem with their networks and EV1 says my system is running as normal.

Could this be an issue with their IP from their location being blocked or blacklisted as it reaches EV1? Or is it something with the referring Cox network?

Anyone ever experienced this?? Anyone have any ideas or suggestions? Any help at all would be so incredibly appreciate...thx much.

-Shaun-
shaun@eyeonstudio.com

Are all ports blocked, or can they get email or see web pages?

Try to Traceroute and Ping their office IP from your server ssh/root, have them do the same (to your server) from their office. It may help you identify where the roadblock is...

Check you iptables:
iptables -L | grep 999.999.999.999
where 999.999.999.999 is the blocked IP address

If you're using APF and/or AntiDOS/BFD, check your blacklist(s)! ...
grep DROP /var/log/messages | tail -200
... will tell you what IP's APF is dropping.

Good luck!

Paul

It could be a block. You might want to get their Cox IP address and ask EV1 if it's blocked. While you're at it, get traceroutes both directions (have them provide one from their IP to your server, and you do one from you server to their IP). That way if it's not a block you already have the infomation for the next step (having EV1 check for network problems in the path). It wouldn't surprose me to see it blocked or a problem at Cox that they aren't admitting to. Another possibility (depending on what the traceroute looks like from them to you) is that it's never making it out of their company LAN.

Thanks for the response guys...I have tried to ping and trace rt and I get a timed out once it hits the EV1.net. I disable my firewall...still get a timed out.

My gut feeling is the referring IP from their office is being blacklisted...though not entirely sure.

What's the easiest way to determine that? It's like pulling teeth to get Cox Communication to investigate.

-Shaun-

Sorry forgot to add to the last email...

they cannot get email or anything associated with their IP or domain. They can hit any other web page yahoo, google whatever, just not their own using their Cox Cable modem, but can with their AOL dialup...this is all really frustrating!!

-Shaun-

If it's blocked at the EV1 routers, EV1 can unblock it... provided that IP hasn't recently been attacking the EV1 network (or has somehow triggered the appearance of an attack).

One other thing you may want to look at is the TippingPoint logs for your server (in the Monitoring section of the Members area, IPS Blocked Packets). Perhaps they have an infection on a machine, or some other issue, that's causing TP to block them.

Thx guys, I'll look into those suggestions right away...I appreciate your help.

If anyone else agrees or has any other ideas please let me know, I'll keep checking this forum.

thx much...

-Shaun-

If your TippingPoint logs are clean, be sure you have also cleared your iptables with:

iptables --flush

Otherwise the IP will still be blocked.

Good luck!

Paul

Another possible quick fix... if they have a dynamic IP... they can usually reset their cable modem and get a new IP... that should get around whatever IP block they're having. If they have a fixed IP, no such luck!

Good Luck,

Paul

Thx Paul...I will try that as well.

-Shaun-

I had a similiar situation happen with a QWEST customer

If you are using APF and dont have the most recent version, take a look at your reserved.networks file.. It may be blocking one of the IP address ranges that COX is now using