0

I have home computers A (mac) and B (Linux, Ubuntu 16.04) and server S (Linux, Ubuntu 16.04). A can connect to S just fine though ssh, http, telnet, etc. B used to be able to connect to S just fine, but no longer can. All connections from B to S time out. Both A and B are behind the same router and B's network is otherwise perfectly usable; it can ssh to other servers and make normal internet connections without issue.

Initially, I suspected fail2ban was blocking B as it might have connected too frequently. After restarting fail2ban a few days ago, B was able to connect to S, but only sporadically. Today, even after restarting or stopping fail2ban, B is no longer able to make any connection to S, except for ping.

I checked to see if there were blocking rules in iptables, but the rule list was empty. I don't see any messages in syslog, auth.log, or faillog.

Where do I start looking to debug this issue? What services on Linux deal with blocking/accepting incoming connections? Is it possible that the connection from B to S is being blocked by B?

Just now while testing, I got two connections from B to S to go through. On the server I could see (through iptables) that these went through fail2ban without issue, so I don't think the blocking is from fail2ban. After those two, I couldn't get any more connections from B to S. Throughout this, A can connect to S without issue.

Furthermore, I tried machine C, also Linux ubuntu 16.04, which has never connected to S before today, and even it is unable to obtain a connection, so I don't think the blocking is on the client side.

Thanks in advance!

2
  • 1
    Eliminate unrelated factors by rebooting the router that connects A & B to the network containing S and connecting without the need for DNS (which might be misconfigured). Attach the full iptables -nL to your question, maybe its in there.
    – user475162
    Jul 15, 2017 at 7:00
  • If machines A B C are behind the same router, I'm guessing they have the same public IP address that S is seeing. My wild guess would be dropbear (or whatever ssh server you're using) + your other servers may block multiple simultaneous accesses from the same IP address.
    – user59328
    Jul 15, 2017 at 14:09

0

You must log in to answer this question.

Browse other questions tagged .