0

On my laptop i do:

 openssl s_client  -connect w00d8dd4.kasserver.com:465

I can see that the connection works. I can also do :

telnet w00d8dd4.kasserver.com 465

Also no problem.

Now, if I log in to my cloud server - and run the same command(s) as above - such as:

 openssl s_client  -connect w00d8dd4.kasserver.com:465

Then there is NO output, nothing happens even after several seconds.

However, if I do :

openssl s_client -connect kyle.com:443 -showcerts

it immediately connects. I have also tested with -tls1 and -debug switches. There is no difference.

I believe, this might be due to certain outgoing connection being blocked by firewall. How can I debug?

I have seen this question - but I was not able to find a proper guide. I have installed ca-certificates (20211016ubuntu0.22.04.1). The cloud serve is running UBuntu :

uname -a says :

Linux myStep-ubuntu-4gb-nbg1-2 5.15.0-67-generic #74-Ubuntu SMP Wed Feb 22 14:14:39 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

UPDATE

I have tried tcptraceroute -p 465 w00d8dd4.kasserver.com from the could server. It finds a route to the target, the result is:

 1  172.31.1.1  6.736 ms  5.755 ms  5.271 ms


2  17332.your-cloud.host (49.12.141.110)  0.447 ms  0.311 ms  0.280 ms
 3  * * *
 4  static.173.0.47.78.clients.your-server.de (78.47.0.173)  1.230 ms  0.834 ms  0.914 ms
 5  spine12.cloud1.nbg1.hetzner.com (78.47.3.45)  16.399 ms  0.911 ms  1.044 ms
 6  213-239-239-141.clients.your-server.de (213.239.239.141)  1.003 ms  0.515 ms  0.701 ms
 7  core0.fra.hetzner.com (213.239.252.25)  3.715 ms  3.788 ms  3.842 ms
 8  ipv4.de-cix.fra.de.as34788.all-inkl.com (80.81.192.119)  21.491 ms  21.468 ms  21.351 ms
 9  dd5114.kasserver.com (85.13.130.50) [open]  21.720 ms  21.228 ms  21.275 ms
3
  • “How can I debug?” - Are you positive that has a route to “w00d8dd4.kasserver.com”, because you the domain that works, isn’t that domain. If you suspect the firewall just explicitly allow traffic on the desired port
    – Ramhound
    Mar 11, 2023 at 17:50
  • > positive that has a route to “w00d8dd4.kasserver.com”, I can reach it from my laptop. Do you mean that I am lacking a route to it from my cloud server?
    – Sean
    Mar 11, 2023 at 17:59
  • That was my question to you.
    – Ramhound
    Mar 11, 2023 at 18:16

1 Answer 1

0

If you're testing this against your own server, a packet capture is a good start. It tells you whether the target system (which must be doing the capture) is actually receiving the packets at all.

tcpdump and tshark are two common tools that work via SSH (Wireshark being a graphical one). For example, to capture all packets from and/or to port 465, use:

tcpdump -n -i eth0 "port 465"

tshark -n -i eth0 -f "port 465"

You can additionally run the same capture on the source system as well – if you see certain packets leaving the source machine but not arriving at the target, that directly means something along the way is blocking them.

Meanwhile, if the target server does receive a TCP SYN packet to its port 465 but sends nothing back, then it's the server's own firewall that is likely to be blocking the packet instead. (Received packets are captured before the target system's firewalls such as iptables have a chance to drop them – though, of course, after all intermediate firewalls.)

5
  • Ah, this is nice. I get: 6 31.557208291 my.ip.add.ress → target.ip.add.ress TCP 74 [TCP Retransmission] [TCP Port numbers reused] 51176 → 465 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=110710653 TSecr=0 WS=128 and it keeps on repeating. So something is blocking the TCP packets? i have already ran sudo ufw allow 25/tcp and sudo ufw allow 465/tcp in the source.
    – Sean
    Mar 11, 2023 at 18:04
  • PS remote server is not my server ...
    – Sean
    Mar 11, 2023 at 18:05
  • @Sean - Ask the owner of the port is blocked.
    – Ramhound
    Mar 11, 2023 at 18:17
  • Wait, so did you get this capture from the server or from your laptop? Mar 11, 2023 at 21:10
  • @user1686 i got this capture, when running tshark on the could server (ssh to the cloud server from laptop)
    – Sean
    Mar 12, 2023 at 3:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .