IP Blocked?

[Puma1337]

I am having a weird problem. One person is unable to access our zimbra server for some reason. It is only at their house and I have added their IP address to allow in our firewall and there was no block on their IP address previously. I am able to access it from that computer if I am using a proxy but I can't find anything in my iptables blocking them.

When I search IP tables this is what I get:

mail ~: iptables -L -n --line | grep xx.xxx.xx.xxx
1 ACCEPT all -- xx.xxx.xx.xxx 0.0.0.0/0
1 ACCEPT all -- 0.0.0.0/0 xx.xxx.xx.xxx

Can someone please help me figure out why they can't connect? They were able to access it fine for the past year or so and then all of a sudden it stopped working the other day and I made no changes to anything.

Thanks.

[Saturdays]

Originally Posted by Puma1337

I am having a weird problem. One person is unable to access our zimbra server for some reason. It is only at their house and I have added their IP address to allow in our firewall and there was no block on their IP address previously. I am able to access it from that computer if I am using a proxy but I can't find anything in my iptables blocking them.

When I search IP tables this is what I get:

mail ~: iptables -L -n --line | grep xx.xxx.xx.xxx
1 ACCEPT all -- xx.xxx.xx.xxx 0.0.0.0/0
1 ACCEPT all -- 0.0.0.0/0 xx.xxx.xx.xxx

Can someone please help me figure out why they can't connect? They were able to access it fine for the past year or so and then all of a sudden it stopped working the other day and I made no changes to anything.

Thanks.

you might check it after disabling the firewall on the local machine. also, a traceroute from the local machine to the zimbra server will help in determining the problem.

[Puma1337]

I have completely disabled the firewall and it still can't connect.

Also, I have run tcpdump to see if the packets are hitting the server and they are.

[phoenix]

Originally Posted by Puma1337

One person is unable to access our zimbra server for some reason

What do you mean by 'unable to access'? Perhaps you could get them to try some diagnostics from their end, a telnet to the server might be a good place to start?

[Puma1337]

I tried diagnosing it on their end myself. They are unable to connect to the server in any way. They cannot ping it, they cannot access it via web browser, they cannot ssh or in any other form.

[phoenix]

Originally Posted by Puma1337

I tried diagnosing it on their end myself. They are unable to connect to the server in any way. They cannot ping it, they cannot access it via web browser, they cannot ssh or in any other form.

Might that not imply they have a firewall problem or perhaps a DNS problem (you haven't actually said what error or response the user sees)?

[Puma1337]

Its not a firewall problem because I can access it from a proxy on their computer. And they also don't have any additional firewall other than their router.

From a web browser it says the server is taking too long to respond.

From ping it says request timed out.

From ssh it says cannot connect to server.

I changed their DNS and same issue.

[phoenix]

Originally Posted by Puma1337

Its not a firewall problem because I can access it from a proxy on their computer. And they also don't have any additional firewall other than their router.

From a web browser it says the server is taking too long to respond.

From ping it says request timed out.

From ssh it says cannot connect to server.

I changed their DNS and same issue.

Well, to me, those issues sound like it's being blocked somewhere.

[Puma1337]

I know it is being blocked somewhere, but I don't know where or by what.

[phoenix]

Originally Posted by Puma1337

I know it is being blocked somewhere, but I don't know where or by what.

Neither do I but I guess you have several choices: it's either the users PC and firewall; the ISP at the users end; your firewall; your ISP; You could try a traceroute and see where it dies, can you actually telnet (or ping or ssh) to the user PC? Does the user have a connection with a NAT router on it? Has that been modified? Is there another PC that can be used by the user (that has a different operating system? Has the user had the MTU changed (check that it's still set to the correct value) on their PC, that can cause connection problems. Has this just started happening? Has the user done any system updates recently? Is this a Windows PC or some other operating system? Is it actually a PC or a laptop, if it's a laptop can it be tried from another location (IP address)? Is the user using a wifi connection or an ethernet cabled connection? Just a few thought for you to while away the end of the year.