Ubuntu – Server Cannot Ping Itself but LAN Computers Can

pingUbuntu

Today my Ubuntu 17.10 server suddenly lost its ability to connect to its own IP services. It seems to be working perfectly as far as other computers on the network are concerned; for example, other computers can ping it, and they can access the server's web service and make SSH connections to the server.

The server itself, however, cannot even ping its own IP address that other computers can readily access. The server can ping other computers on the network as well as computers outside of the LAN, just not itself. (The server can ping its localhost address though.)

I'm not even sure where to begin to look. The logs are fine, processor load is normal, network activity is normal, and the only piece of software that had been updated within hours before the error appeared is the Google Chrome browser.

The network is setup as follows:

$ ip -4 addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: p4p1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    inet 192.168.2.2/24 brd 192.168.2.255 scope global p4p1
       valid_lft forever preferred_lft forever

$ ip -4 route
default via 192.168.2.254 dev p4p1 onlink 
169.254.0.0/16 dev p4p1 scope link metric 1000 
192.168.2.0/24 dev p4p1 proto kernel scope link src 192.168.2.2

And,

$ ping -c 1 192.168.2.3
PING 192.168.2.3 (192.168.2.3) 56(84) bytes of data.
64 bytes from 192.168.2.3: icmp_seq=1 ttl=64 time=1.06 ms

--- 192.168.2.3 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.067/1.067/1.067/0.000 ms

but,

$ ping -c 1 192.168.2.2
PING 192.168.2.2 (192.168.2.2) 56(84) bytes of data.

--- 192.168.2.2 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

I haven't been able to Google any answers that discuss a server that cannot ping itself while all other computers seem to be able to access it. Any suggestions?

Best Answer

The culprit turned out to be sshguard, which uses iptables of its own and wasn't affected when I turned the standard firewall off in order to locate the problem.

I had whitelisted the IP address in sshguard, but the log reveals that apparently it was ignored. (I have narrowed down why the local IP attempted to make SSH connections; it wasn't an attack.) Here's the revealing log entry in /var/log/sshguard:

Sep 18 11:28:13 home sshguard[983]: 192.168.2.2: not blocking (on whitelist)
Sep 18 11:28:13 home sshguard[15315]: Blocking 192.168.2.2 for 240 secs (3 attacks in 121 secs, after 1 abuses over 121 secs)

I'll have to either track down why sshguard ignores the whitelisting or change to another throttling mechanism.

Related Topic