container cannot ping qfdndomain.com

ganewbie · Jan 27, 2015

Hello,
Have installed ISPCONFIG3 in a Debian wheezy container.
Before the ISPConfig3 install the container can ping google.com and 8.8.8.8
after ISPConfig3 can still ping 8.8.8.8 but cannot ping google.com
Here is the fire wall of the container.

root@xxxxxxx:~# iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
fail2ban-dovecot-pop3imap tcp -- anywhere anywhere multiport dports pop3,pop3s,imap2,imaps
fail2ban-pureftpd tcp -- anywhere anywhere multiport dports ftp
fail2ban-sasl tcp -- anywhere anywhere multiport dports smtp
fail2ban-ssh tcp -- anywhere anywhere multiport dports ssh

DROP tcp -- anywhere loopback/8
ACCEPT all -- anywhere anywhere
DROP all -- 224.0.0.0/4 anywhere
PUB_IN all -- anywhere anywhere
PUB_IN all -- anywhere anywhere
PUB_IN all -- anywhere anywhere
PUB_IN all -- anywhere anywhere
PUB_IN all -- anywhere anywhere
DROP all -- anywhere anywhere

Chain FORWARD (policy DROP)
target prot opt source destination
DROP all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
PUB_OUT all -- anywhere anywhere
PUB_OUT all -- anywhere anywhere
PUB_OUT all -- anywhere anywhere
PUB_OUT all -- anywhere anywhere
PUB_OUT all -- anywhere anywhere

Chain INT_IN (0 references)
target prot opt source destination
ACCEPT icmp -- anywhere anywhere
DROP all -- anywhere anywhere

Chain INT_OUT (0 references)
target prot opt source destination
ACCEPT icmp -- anywhere anywhere
ACCEPT all -- anywhere anywhere

Chain PAROLE (16 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain PUB_IN (5 references)
target prot opt source destination
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp echo-reply
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp echo-request
PAROLE tcp -- anywhere anywhere tcp dpt:ftp-data
PAROLE tcp -- anywhere anywhere tcp dpt:ftp
PAROLE tcp -- anywhere anywhere tcp dpt:ssh
PAROLE tcp -- anywhere anywhere tcp dpt:smtp
PAROLE tcp -- anywhere anywhere tcp dpt:domain
PAROLE tcp -- anywhere anywhere tcp dpt:http
PAROLE tcp -- anywhere anywhere tcp dptop3
PAROLE tcp -- anywhere anywhere tcp dpt:imap2
PAROLE tcp -- anywhere anywhere tcp dpt:https
PAROLE tcp -- anywhere anywhere tcp dpt:submission
PAROLE tcp -- anywhere anywhere tcp dpt:imaps
PAROLE tcp -- anywhere anywhere tcp dptop3s
PAROLE tcp -- anywhere anywhere tcp dpt:mysql
PAROLE tcp -- anywhere anywhere tcp dpt:http-alt
PAROLE tcp -- anywhere anywhere tcp dpt:tproxy
PAROLE tcp -- anywhere anywhere tcp dpt:webmin
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT udp -- anywhere anywhere udp dpt:mysql
DROP icmp -- anywhere anywhere
DROP all -- anywhere anywhere

Chain PUB_OUT (5 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain fail2ban-dovecot-pop3imap (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-pureftpd (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-sasl (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere

Chain fail2ban-ssh (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Click to expand...

Is it a fire wall issue?
Or Where do I look?
Thanks,

till · Jan 27, 2015

This can be a firewall issue, depending on your container technology that is sued for the vm. Stop the firewall and check if you ping googgle again then.

ganewbie · Jan 27, 2015

I am using OpenVZ container.
Yes disable the firewall solved the problem.

/etc/init.d/bastille-firewall stop
Click to expand...

I see errors when I started it again, is it normal?

root@xxxxxx:~# /etc/init.d/bastille-firewall start
libkmod: ERROR ../libkmod/libkmod.c:554 kmod_search_moddep: could not open moddep file '/lib/modules/2.6.32-openvz-042stab094.7-amd64/modules.dep.bin'
iptables v1.4.14: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
iptables v1.4.14: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
libkmod: ERROR ../libkmod/libkmod.c:554 kmod_search_moddep: could not open moddep file '/lib/modules/2.6.32-openvz-042stab094.7-amd64/modules.dep.bin'
libkmod: ERROR ../libkmod/libkmod.c:554 kmod_search_moddep: could not open moddep file '/lib/modules/2.6.32-openvz-042stab094.7-amd64/modules.dep.bin'
libkmod: ERROR ../libkmod/libkmod.c:554 kmod_search_moddep: could not open moddep file '/lib/modules/2.6.32-openvz-042stab094.7-amd64/modules.dep.bin'
Setting up IP spoofing protection... done.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
Allowing traffic from trusted interfaces... done.
Setting up chains for public/internal interface traffic... done.
Setting up general rules... done.
Setting up outbound rules... done.
touch: cannot touch `/var/lock/subsys/bastille-firewall': No such file or directory
root@xxxxxx:~# ping google.com
Click to expand...

Here is the status of firewall in case it helps

root@xxxxx:~# /etc/init.d/bastille-firewall status
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP tcp -- !lo * 0.0.0.0/0 127.0.0.0/8
16 1548 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- * * 224.0.0.0/4 0.0.0.0/0
0 0 PUB_IN all -- eth+ * 0.0.0.0/0 0.0.0.0/0
0 0 PUB_IN all -- ppp+ * 0.0.0.0/0 0.0.0.0/0
0 0 PUB_IN all -- slip+ * 0.0.0.0/0 0.0.0.0/0
133 17085 PUB_IN all -- venet+ * 0.0.0.0/0 0.0.0.0/0
0 0 PUB_IN all -- bond+ * 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT 16 packets, 1548 bytes)
pkts bytes target prot opt in out source destination
0 0 PUB_OUT all -- * eth+ 0.0.0.0/0 0.0.0.0/0
0 0 PUB_OUT all -- * ppp+ 0.0.0.0/0 0.0.0.0/0
0 0 PUB_OUT all -- * slip+ 0.0.0.0/0 0.0.0.0/0
128 20589 PUB_OUT all -- * venet+ 0.0.0.0/0 0.0.0.0/0
0 0 PUB_OUT all -- * bond+ 0.0.0.0/0 0.0.0.0/0

Chain INT_IN (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

Chain INT_OUT (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0

Chain PAROLE (16 references)
pkts bytes target prot opt in out source destination
57 7901 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0

Chain PUB_IN (5 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 3
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 11
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 8
0 0 PAROLE tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:20
0 0 PAROLE tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21
57 7901 PAROLE tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
0 0 PAROLE tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25
0 0 PAROLE tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
0 0 PAROLE tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
0 0 PAROLE tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:110
0 0 PAROLE tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:143
0 0 PAROLE tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
0 0 PAROLE tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:587
0 0 PAROLE tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:993
0 0 PAROLE tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:995
0 0 PAROLE tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:3306
0 0 PAROLE tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080
0 0 PAROLE tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8081
0 0 PAROLE tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:10000
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:53
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:3306
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0
76 9184 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

Chain PUB_OUT (5 references)
pkts bytes target prot opt in out source destination
125 16113 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-dovecot-pop3imap (0 references)
pkts bytes target prot opt in out source destination
57 5603 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-pureftpd (0 references)
pkts bytes target prot opt in out source destination
5 200 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-sasl (0 references)
pkts bytes target prot opt in out source destination
14 620 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-ssh (0 references)
pkts bytes target prot opt in out source destination
839 120K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Click to expand...

FYI, the IP of the container is a private IP address, in case it make a difference.
Thanks,

ganewbie · Jan 28, 2015

Hi again,
With more reading, it seems that my problem may be related to this bug.
http://bugzilla.openvz.org/show_bug.cgi?id=2755
yet I cannot find this option anywhere where I can change it from 1 to 0.
Any help is appriciated

Cheers,

George

ganewbie · Feb 5, 2015

Disable the fire wall of the container fixed the problem as we do not need it in vps.

Log in or Sign up

container cannot ping qfdndomain.com

ganewbie Member HowtoForge Supporter

till Super Moderator Staff Member ISPConfig Developer

ganewbie Member HowtoForge Supporter

ganewbie Member HowtoForge Supporter

ganewbie Member HowtoForge Supporter

Share This Page

Log in or Sign up

container cannot ping qfdndomain.com

ganewbie Member HowtoForge Supporter

till Super Moderator Staff Member ISPConfig Developer

ganewbie Member HowtoForge Supporter

ganewbie Member HowtoForge Supporter

ganewbie Member HowtoForge Supporter

Share This Page

Useful Searches