Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have been staring at this for 2 hours now and can't figure it out. My webserver was running fine until earlier today.

But now it can't be accessed from the Internet.

The server is apache2, but that's running fine because I can access sites using wget on the server (localhost/sitename) but any attempt to access the site from outside, and it times out.

I've done netstat -plnt and the response is

    Active Internet connections (only servers)
    Proto Recv-Q Send-Q Local Address           Foreign Address         State       
    PID/Program name
    tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN      648/mysqld
    tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1056/apache2
    tcp        0      0 0.0.0.0:21              0.0.0.0:*               LISTEN      546/vsftpd
    tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      557/sshd
    tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      963/exim4
    tcp        0      0 0.0.0.0:538             0.0.0.0:*               LISTEN      968/gdomap
    tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      1056/apache2
    tcp6       0      0 :::22                   :::*                    LISTEN      557/sshd
    tcp6       0      0 ::1:25                  :::*                    LISTEN      963/exim4

I can ssh to the server but not FTP (or access by www) Ping is turned off anyway so I haven't done that.

I've also ran nc -vt 1.2.3.4 80 (not my real address) and got Connection Timed Out.

Then I checked /sbin/iptables -L and the response is

    Chain INPUT (policy ACCEPT)
    target     prot opt source               destination

    Chain FORWARD (policy ACCEPT)
    target     prot opt source               destination

    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination

But even after I do sudo /sbin/iptables -I INPUT 1 -p tcp --dport http -j ACCEPT it still doesn't work

ufw status is Inactive

There seems to be another firewall which is accessed by a web based control panel (it's Digital Mines), but I've checked and both ports 80 and 443 have rules allowing 0.0.0.0/0

I'm at my wits end now, I am searching on the internet and just keep getting the same answers - check iptables, check ufw.

Any ideas?

Edit One other thing, I can't access external websites from the server either!

share|improve this question
    
Are you being routed correctly? Can you ping the server? –  Braiam Nov 17 '13 at 2:09
    
No, but ping is disabled on the server anyway and to be honest I am not sure how to enable it. –  colmde Nov 17 '13 at 2:53
add comment

1 Answer 1

Realised I had never posted the "Resolution" to this.

It seems our server was hacked and it was being used to launch DOS attacks.

The server is on the Amazon cloud, however it comes through a chain of two resellers. (Don't ask me why?). Amazon notified the first reseller that they were blocking access because of the above reason, and they tried to notify the second. It being the weekend, nobody from the second reseller received the message to tell us.

Thanks for trying anyway

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.