Strange network problem

[LiamC]

I can't get to www.autosport.com from my home network.

"...
The following error was encountered:

• Connection to 195.225.217.194 Failed

The system returned:
(110) Connection timed out"...

I know it's alive, because I can get to it from work.
It's been happening for a few days. All other sites that
I've tried resolve just fine.
Tried flushing the DNS & rebooting the Smoothwall.
Doing a whois from the Smoothy gives a not found error.
I can't use OpenDNS or any other DNS from behind the Smoothy

Checked for malware with Malwarebytes and Spybot.

Anybody have any ideas?

 

[time]

Change ISPs? You're not with TPG by any chance?

 

[LiamC]

Change ISPs? You're not with TPG by any chance?

No, Optus. I just posted this from my laptop, and it can go there just fine. A rogue HOSTS file entry?

 

[Mercutio]

If they have forums or a comments system it's possible that someone on the same netblock as your home got banned for trolling or something.

 

[ddrueding]

You should be able to change DNS from behind a smoothwall, I do it all the time. Just hard-code the DNS into your workstation try the following:

8.8.8.8
4.2.2.2
4.2.2.4

 

[LiamC]

You should be able to change DNS from behind a smoothwall, I do it all the time. Just hard-code the DNS into your workstation try the following:

8.8.8.8
4.2.2.2
4.2.2.4

I would have thought so. I tried three different DNS servers and every time I changed to a fixed (rather than automatic) DNS, I couldn't get out to any internet address.

I should point out that I originally thought this was network wide, but my laptop works fine, so it looks to be more machine specific.

 

[time]

Firstly, it's got nothing to do with DNS because the URL resolved to the correct IP address ... but I think Liam's already figured that out.

It looks like anyone can ping the IP address, so that's probably a first step to try.

I assume you've tried a different browser?

You'd obviously want to try disabling any antivirus or firewall software.

As a random lateral test, how about you give the PC a static IP address in a different part of the subnet range, eg a high number above 200 to avoid DHCP conflicts.

 

[LiamC]

Hmmm. Turned off firewall. Still can't reach it.

Ping:

C:\Program Files\Support Tools>ping autosport.com

Pinging autosport.com [195.225.217.194] with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 195.225.217.194:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

Yes I had tried IE8 & Opera 10.10 as well as FF. None can reach autosport.

 

[LiamC]

Found out that the only DNS server I can use with this machine is the Smoothwall box

If I set the DNS to any IP other than the Smoothy, I can't access any of the internet. Maybe the Smoothys DNS is FUBARed?

 

[LiamC]

Flushed the Smoothy DNS cache which didn't fix the problem

killall dnsmasq
dnsmasq -r /etc/resolv.conf.dnsmasq

 

[LiamC]

hmmm. I can get to it via a cloaking/masking site:

http://www.the-cloak.com/login.html


Now it's getting weird. I can get to it via my laptop (wireless connection--just need to check that it wasn't in offline mode). I can't get to it via any other PC on the network, unless cloaked.

 

[time]

I said ping the IP address, not the URL. Try 195.225.217.194 directly. It seems pretty clear you're being blocked at an IP level, not a DNS level, despite the Smoothwall shenanigans.

The-Cloak is a proxy server. It doesn't prove anything.

*IF* you really can access successfully with your laptop, but not with more than one other computers, it's most probably a Smoothwall issue. You should try bypassing it with your main PC just to confirm this.

This is why I suggested changing your local IP address, in case there's an entry in Smoothwall that references the current address.

 

[LiamC]

Sorry, I wasn't clear. I did try to ping the IP and it was blocked as welll. I checked the laptop and it is also blocked. I also tried changing IP as you suggested but forgot to include the results of that test. I was still blocked. Thank you for your help/suggestions time.

But tried just now and it just worked. Perhaps autosport were filtering because of spam and just made a (now corrected) mistake?

 

[Sol]

They would have been filtering on your ip address which, assuming you're using smoothwall as a NAT proxy, would be the same on your laptop and the desktop.

My first thought given the DNS oddness combined with this issue would be something nasty having wormed it's way in to your network stack. I'd boot in to a linux live distro, see how that liked having the DNS server settings changed and maybe run a virus scanner over the whole system.

Before that you could try going to some well known online virus scanner site like housecall. Blocking those sort of services is one of the reasons malware tries to get in to the network stack so a complete failure to access those sites would be indicative.

 

[Handruin]

What if you tried a release/renew on the WAN side IP to get a new lease from your ISP? If you're being blocked, maybe this will get you past that?

 

[timwhit]

What if you tried a release/renew on the WAN side IP to get a new lease from your ISP? If you're being blocked, maybe this will get you past that?

If you do this by unplugging your modem (cable or DSL), make sure to leave it unplugged for several minutes or you may end up with the same IP as before.

 

[time]

My first thought given the DNS oddness combined with this issue would be something nasty having wormed it's way in to your network stack.

Yeah, the only reason I didn't go for that is that Liam *implied* the problem affected more than one PC. Is that the case?

Good to hear that it's now working, anyway. Cheers!

 

[LiamC]

Yeah, the only reason I didn't go for that is that Liam *implied* the problem affected more than one PC. Is that the case?

Good to hear that it's now working, anyway. Cheers!

Yes, it affected the entire network. I thought I made that clear, but obviously not. I originally thought my notebook was unaffected, but I wasn't sure. Further checks revealed that my notebook was also Affected. Apologies.

 

[LiamC]

Before that you could try going to some well known online virus scanner site like housecall. Blocking those sort of services is one of the reasons malware tries to get in to the network stack so a complete failure to access those sites would be indicative.

That's a cool piece of information there Sol. Thanks.

 

[LiamC]

Handy, timwhit,

everytime I've rebooted the modem, I ended up on the same IP. But I've never tried a release/renew from the Smoothy (or just leaving it off for several minutes), so I'm going to try it, it's always handy (thank you, I'm here all week) to have these little tricks in the arsenal.

 

[Sol]

If you're on a DSL connection does your smoothwall handle the PPP authentication? If not then even releasing the IP manually may not work as it is probably held by the modem and you'll need to log in to the modem to release it.
If you're on a cable connection then you might have to experiment with several values of "several minutes". In the past I've had to leave cable modems unplugged for almost 24 hours before the DHCP lease was properly reset at the ISPs end. (This was an extreme case with a crappy cable ISP, but in Australia are there any other kind?)