Changed Web Server Static IP, then ERR_CONNECTION_REFUSED

OP
JLAIP

JLAIP

drhowarddrfine said:
If I'm guessing correctly, your page involves <frameset> (which is also many years obsolete) and is trying to load the index page from somewhere else. That is where the error occurs. Look into that. Your server is being accessed just fine.
Click to expand...
I appreciate the input, but that has nothing to do with the problem I'm having.
 

Attachments

  • refused.jpg
    refused.jpg
    37.3 KB · Views: 27
OP
JLAIP

JLAIP

VladiBG said:
check the ipfw list

In your rc.conf you have pf_enable which is for pf firewall and also ipfilter_enabled. So check your pf rules. You are not using IPFW but ipf (IPFilter)
Click to expand...
Whichever firewalls we're running, which of the firewall config files include the server's static IPs?
 
D

drhowarddrfine

Code: 
<html><head><title>JOHNLENNONPROJECT.COM</title><meta name="keywords" content=""></head><frameset rows="100%", *" border="0" frameborder="0"><frame src="http://triumphpc.com/john-lennon-project/" name="JOHNLENNONPROJECT.COM"></frameset></html>
 
VladiBG

VladiBG

use /etc/ipf.rules to edit the ipf set or use ipfstat -io to display the current input / output rules. When you are sure that the firewall is allowing the port80 traffic check the apache access log.
 
OP
JLAIP

JLAIP

drhowarddrfine said:
Code: 
<html><head><title>JOHNLENNONPROJECT.COM</title><meta name="keywords" content=""></head><frameset rows="100%", *" border="0" frameborder="0"><frame src="http://triumphpc.com/john-lennon-project/" name="JOHNLENNONPROJECT.COM"></frameset></html>
Click to expand...
The only code on the web server that's changed between the time it last worked and now (when it doesn't) is the IP address changes made to /etc/rc.conf. Why do you think the cause of the "ERR_CONNECTION_REFUSED" is a frameset?
 
SirDice

SirDice

Administrator
Staff member
Administrator
Moderator
If firewalls are causing it I would expect to see a 'connection timed-out' error due to the firewall dropping the traffic. Connection refused means you are receiving a RST in response to a SYN. In other words, the port is closed. Traffic is most likely not being dropped by a firewall. There's simply nothing listening on that port.
 
D

drhowarddrfine

JLAIP said:
The only code on the web server that's changed between the time it last worked and now (when it doesn't) is the IP address changes made to /etc/rc.conf. Why do you think the cause of the "ERR_CONNECTION_REFUSED" is a frameset?
Click to expand...

Because both Chromium and Firefox say, "triumphpc.com refused to connect." It's not the frame markup. It has to do with that server and not the john lennon one.
 
jbodenmann

jbodenmann

SirDice said:
If firewalls are causing it I would expect to see a 'connection timed-out' error due to the firewall dropping the traffic. Connection refused means you are receiving a RST in response to a SYN. In other words, the port is closed. Traffic is most likely not being dropped by a firewall. There's simply nothing listening on that port.
Click to expand...
The picture showing the output of sockstat -4 -l posted by JLAIP earlier in this thread would suggest otherwise. Unless I am missing something there is clearly httpd listening on port 80 on all interfaces.
So unless this is some more advanced configuration with virtual networks, VMs/jails and whatnot I'd argue that we're tracking down the problem from the wrong side. This would align with what drhowarddrfine just posted.

JLAIP Is triumphpc.com served by the very same host? Or is this separate host somewhere "behind" this machine we're currently talking about?
I did notice different names showing up in the shell command input line in your pictures. However, I don't know whether that is just the currently logged in username. In case that is the hostname, I think you're not telling us the whole story here.
 
VladiBG

VladiBG

Also check if you are using virtualhost config in your httpd and if it's set to serve only the old ip address you need to change the ip address there too

For example:
<VirtualHost 192.168.1.170:80>
ServerName mydomain.com
DocumentRoot /var/www/html/mydomain.com/public_html
ErrorLog /var/www/html/mydomain.com/logs/error.log
CustomLog /var/www/html/cmydomain.com/logs/requests.log combined
Options +Includes
</VirtualHost>
Click to expand...

You need to change it
<VirtualHost *:80>
Click to expand...
OR
<VirtualHost New_IP_Address:80>
Click to expand...
 
OP
JLAIP

JLAIP

VladiBG said:
Also check if you are using virtualhost config in your httpd and if it's set to serve only the old ip address you need to change the ip address there too
For example:
You need to change it
OR
Click to expand...
I don't know if the server's using virtualhost, but if the old static IP's in there, then that may be the problem.
I hate to ask, but can you give me an idea where to look for the file I'm looking for?
 
VladiBG

VladiBG

apache configuration should be in /usr/local/etc/apache...
apache logs goes into /var/log

edit:
did you check the firewall if port 80 is open on the new ip address?
 
OP
JLAIP

JLAIP

jbodenmann said:
JLAIP Is triumphpc.com served by the very same host? Or is this separate host somewhere "behind" this machine we're currently talking about?
I did notice different names showing up in the shell command input line in your pictures. However, I don't know whether that is just the currently logged in username. In case that is the hostname, I think you're not telling us the whole story here.
Click to expand...
I'm telling you as much as I know. And, at this point, what I know isn't alot....which is why I came here.
Here's the physical layout: there are two servers—email and web. The email server has two NIC cards and is facing the modem/router. The web server has one NIC and is connected to one of the NICs in the email server.

While I've been posting here, I've also been on the phone with the ISP's tech, who just informed me that DHCP is ON in the modem/router. Shouldn't that be off?
 
jbodenmann

jbodenmann

JLAIP said:
I hate to ask, but can you give me an idea where to look for the file I'm looking for?
Click to expand...
You could do a system wide grep to find all files listing the old IP. Something along the lines of: grep -rnw / -e '84\.18\.59\.37'. Replace with your old IP accordingly.

JLAIP said:
While I've been posting here, I've also been on the phone with the ISP's tech, who just informed me that DHCP is ON in the modem/router. Shouldn't that be off?
Click to expand...
I assume that this is referring to your router acting as a DHCP server for your local network which is usually fine as your clients might still rely on DHCP. There are exceptions of course but I'd not go down this road yet.
 
OP
JLAIP

JLAIP

VladiBG said:
apache configuration should be in /usr/local/etc/apache...
apache logs goes into /var/log

edit:
did you check the firewall if port 80 is open on the new ip address?
Click to expand...

Re the firewall: I haven't touched the firewall in ages. Our website has been working for 20+ years, so I have to presume that port 80s open.

I found /usr/local/apache1/conf/httpd.conf.

Is httpd.conf the file that was being referencing here...
"Also check if you are using virtualhost config in your httpd and if it's set to serve only the old ip address you need to change the ip address there too"

If so, I don't see any IPs in httpd.conf. Or is that not the correct file?
 
VladiBG

VladiBG

you need to check the firewall first. If it's allowing only the old_IP:80 to be accessed you need to check it . use ipfstat -io or check the /etc/ipf.rules
 
OP
JLAIP

JLAIP

jbodenmann said:
You could do a system wide grep to find all files listing the old IP. Something along the lines of: grep -rnw / -e '84\.18\.59\.37'. Replace with your old IP accordingly.


I assume that this is referring to your router acting as a DHCP server for your local network which is usually fine as your clients might still rely on DHCP. There are exceptions of course but I'd not go down this road yet.
Click to expand...
Re DHCP and the router: I've got static IPs configured in /etc/rc.conf, so what is the router's DHCP supposed to be auto-configuring?

Re grep: I'm not sure what this is telling me?
 

Attachments

  • huntington 011.jpg
    huntington 011.jpg
    94 KB · Views: 25
OP
JLAIP

JLAIP

VladiBG said:
you need to check the firewall first. If it's allowing only the old_IP:80 to be accessed you need to check it . use ipfstat -io or check the /etc/ipf.rules
Click to expand...
What am I checking for in /etc/ipf.rules? But, again, how could the firewall suddenly block web traffic when the only changes have been to /etc/rc.conf?
 
SirDice

SirDice

Administrator
Staff member
Administrator
Moderator
JLAIP said:
Our website has been working for 20+ years, so I have to presume that port 80s open.
Click to expand...
Yes, but you haven't changed the IP address in all those years either. When dealing with problems, never assume anything. Check, double-check and verify. Go through everything logically and methodically. Check every step of the way. Just randomly checking some things while assuming something else is correct is a good way to overlook the blindingly obvious.

JLAIP said:
But, again, how could the firewall suddenly block web traffic when the only changes have been to /etc/rc.conf?
Click to expand...
If the firewall is specifically configured to only allow the 'old' IP address (thus blocking traffic to the 'new' IP). Changing the IP address in rc.conf means you're going to need to change the IP everywhere it has been used. And there are many places where this IP address could have been set or stored.
 
jbodenmann

jbodenmann

JLAIP said:
If so, I don't see any IPs in httpd.conf. Or is that not the correct file?
Click to expand...
I don't think that your Apache VirtualHost configuration is the problem as previously shown output of sockstat shows that the Apache HTTP server is listening on all interfaces/IPs on your host.

I feel like we're repeating a lot of stuff here that was already mentioned in the first couple of posts on this topic.
 
covacat

covacat

if your router forwards port 80 to your server and your server has a RFC1918 (192.168.x.x,10.x.x.x.,172.16.x.x)fixed address
then it's probably not your firewall but router's nat rules may have been lost
if your server has a routable ip and is configured on one interface then the isp's modem/router is in bridge mode and they are blocking you from the head office (this happens for residential/home type contracts ) not the device itself (or your firewall is blocking the connections)
 
OP
JLAIP

JLAIP

SirDice said:
Yes, but you haven't changed the IP address in all those years either. When dealing with problems, never assume anything. Check, double-check and verify. Go through everything logically and methodically. Check every step of the way. Just randomly checking some things while assuming something else is correct is a good way to overlook the blindingly obvious.
Click to expand...
It's for that reason that I'm hesitant to muck around with anything other than the one file I changed on both servers: /etc/rc.conf.
If the modem's not the bottleneck, I kind of think there's got to be another config file(s) that contains the old IP. I checked /etc/ipf.rules, but the old IP isn't in there....and I haven't touched it between the time the server was working early this week (with the old modem/IP) and now (with the new modem/IP).
 
OP
JLAIP

JLAIP

jbodenmann said:
I don't think that your Apache VirtualHost configuration is the problem as previously shown output of sockstat shows that the Apache HTTP server is listening on all interfaces/IPs on your host.
I feel like we're repeating a lot of stuff here that was already mentioned in the first couple of posts on this topic.
Click to expand...
Yes.
 
SirDice

SirDice

Administrator
Staff member
Administrator
Moderator
Fire up tcpdump(1) (use a filter or else you might get swamped with unrelated information) on the server. Open the website on your browser. Do you see the connection actually coming in? Is there a response?
 
You must log in or register to reply here.
Top