Обсуждение: Fwd: [pgsql-advocacy] Website: links to wwwmaster.postgresql.org don't work for me

----------  Forwarded Message  ----------

Subject: [pgsql-advocacy] Website: links to wwwmaster.postgresql.org don't
work for me
Date: Monday 17 January 2005 10:55
From: "Michael Paesold" <mpaesold@gmx.at>
To: <pgsql-advocacy@postgresql.org>

On the new www.postgresql.org site there are some links to
wwwmaster.postgresql.org. Those do not work for me from home, I can't even
ping wwwmaster.postgresql.org, although the name does resolve to
194.217.48.42. On the other hand I can ping the address from our hosting
colocation. It's quite strange because the traceroute shows the same from
both locations.

I don't know the reason for that, yet, but I am asking myself, if this URL
wwwmaster.postgresql.org is correct?

The URL can be found, e.g.:
* at http://www.postgresql.org/ftp/v7.4.6/ (ftp/...)
* in the RSS feed
* the mirrors link: http://wwwmaster.postgresql.org/mirror/website

Could some of you tell me, if wwwmaster.postgresql.org works for you? It
would be interesting, if this is just a local problem, or a more general
problem.

(I will also contact my uplink provider for help now.)

Best Regards,
Michael Paesold


---------------------------(end of broadcast)---------------------------
TIP 3: if posting/reading through Usenet, please send an appropriate
      subscribe-nomail command to majordomo@postgresql.org so that your
      message can get through to the mailing list cleanly

-------------------------------------------------------

--
Josh Berkus
Aglio Database Solutions
San Francisco

This is the same problem I reported a while ago.
Weird.

     Oleg

On Mon, 17 Jan 2005, Josh Berkus wrote:

>
>
> ----------  Forwarded Message  ----------
>
> Subject: [pgsql-advocacy] Website: links to wwwmaster.postgresql.org don't
> work for me
> Date: Monday 17 January 2005 10:55
> From: "Michael Paesold" <mpaesold@gmx.at>
> To: <pgsql-advocacy@postgresql.org>
>
> On the new www.postgresql.org site there are some links to
> wwwmaster.postgresql.org. Those do not work for me from home, I can't even
> ping wwwmaster.postgresql.org, although the name does resolve to
> 194.217.48.42. On the other hand I can ping the address from our hosting
> colocation. It's quite strange because the traceroute shows the same from
> both locations.
>
> I don't know the reason for that, yet, but I am asking myself, if this URL
> wwwmaster.postgresql.org is correct?
>
> The URL can be found, e.g.:
> * at http://www.postgresql.org/ftp/v7.4.6/ (ftp/...)
> * in the RSS feed
> * the mirrors link: http://wwwmaster.postgresql.org/mirror/website
>
> Could some of you tell me, if wwwmaster.postgresql.org works for you? It
> would be interesting, if this is just a local problem, or a more general
> problem.
>
> (I will also contact my uplink provider for help now.)
>
> Best Regards,
> Michael Paesold
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 3: if posting/reading through Usenet, please send an appropriate
>      subscribe-nomail command to majordomo@postgresql.org so that your
>      message can get through to the mailing list cleanly
>
> -------------------------------------------------------
>
>

     Regards,
         Oleg
_____________________________________________________________
Oleg Bartunov, sci.researcher, hostmaster of AstroNet,
Sternberg Astronomical Institute, Moscow University (Russia)
Internet: oleg@sai.msu.su, http://www.sai.msu.su/~megera/
phone: +007(095)939-16-83, +007(095)939-23-83

> ----------  Forwarded Message  ----------
>
> Subject: [pgsql-advocacy] Website: links to
> wwwmaster.postgresql.org don't
> work for me
> Date: Monday 17 January 2005 10:55
> From: "Michael Paesold" <mpaesold@gmx.at>
> To: <pgsql-advocacy@postgresql.org>
>
> On the new www.postgresql.org site there are some links to
> wwwmaster.postgresql.org. Those do not work for me from home,
> I can't even
> ping wwwmaster.postgresql.org, although the name does resolve to
> 194.217.48.42. On the other hand I can ping the address from
> our hosting
> colocation. It's quite strange because the traceroute shows
> the same from
> both locations.
>
> I don't know the reason for that, yet, but I am asking
> myself, if this URL
> wwwmaster.postgresql.org is correct?

Yes, it is. The ping issue is probably similar to traceroute issues seen
from some machines. The firewall only allows ICMP echo requests to hit
the machine, and some OS's implement ping/traceroute in different ways -
for example, when tracerouting from borg.postgresql.org (which runs
FreeBSD), we can see the firewall dropping UDP datagrams.

Can you telnet to port 80, and get a reposonse if you type 'get /' and
hit return?

> The URL can be found, e.g.:
> * at http://www.postgresql.org/ftp/v7.4.6/ (ftp/...)
> * in the RSS feed
> * the mirrors link: http://wwwmaster.postgresql.org/mirror/website
>
> Could some of you tell me, if wwwmaster.postgresql.org works
> for you? It
> would be interesting, if this is just a local problem, or a
> more general
> problem.

We've logged over 30,000 file downloads from the mirror network through
there in the last week, and over 5 million web hits on that virtual host
since 21st December, so it's certainly not a general problem.

Regards, Dave.

> > I don't know the reason for that, yet, but I am asking
> > myself, if this URL
> > wwwmaster.postgresql.org is correct?
>
> Yes, it is. The ping issue is probably similar to traceroute issues
> seen from some machines. The firewall only allows ICMP echo requests
> to hit the machine, and some OS's implement ping/traceroute in
> different ways - for example, when tracerouting from
> borg.postgresql.org (which runs
> FreeBSD), we can see the firewall dropping UDP datagrams.
>
> Can you telnet to port 80, and get a reposonse if you type 'get /'
> and hit return?

No, I can't. It does not connect. I am not quite sure what the problem could
be. The only thing I am dubios about is my local xdsl router with NAT -- but
I have not experienced any problem with another site. Perhaps it's just the
combination of the firewall and my router. I will try at work tomorrow.

> We've logged over 30,000 file downloads from the mirror network
> through there in the last week, and over 5 million web hits on that
> virtual host since 21st December, so it's certainly not a general
> problem.
>
> Regards, Dave.

Thank you very much for your response. I just wanted to be sure it's a local
problem. I will come back to the list when I found the problem and/or it's
solution.

Best Regards,
Michael Paesold

> -----Original Message-----
> From: Michael Paesold [mailto:mpaesold@gmx.at]
> Sent: 17 January 2005 21:48
> To: Dave Page; Josh Berkus; PostgreSQL WWW Mailing List;
> pgsql-advocay@postgresql.org
> Subject: Re: [pgsql-www] Fwd: [pgsql-advocacy] Website: links
> to wwwmaster.postgresql.org don't work for me
>
> No, I can't. It does not connect. I am not quite sure what
> the problem could
> be. The only thing I am dubios about is my local xdsl router
> with NAT -- but
> I have not experienced any problem with another site. Perhaps
> it's just the
> combination of the firewall and my router. I will try at work
> tomorrow.

Can you ping and traceroute to demon-gw.vale-housing.co.uk? That's the
upstream router...

> Thank you very much for your response. I just wanted to be
> sure it's a local
> problem. I will come back to the list when I found the
> problem and/or it's
> solution.

It's clearly not a global problem, but I'm concerned that 2 ppl have
reported something similar. I did just have a thought though - we had a
problem on a similar box some time ago routing through broken ecn
(explicit congestion notification) enabled routers. The fix in that case
was to disable ecn on the server. I've just done this on wwwmaster -
could you try it again in case that was it please?

Regards, Dave.

Hi,

I have the same problem connecting to wwwmaster from home...

Dave Page wrote:
> Can you ping and traceroute to demon-gw.vale-housing.co.uk? That's the
> upstream router...

Yes, I can.

But I can't ping / traceroute / connect to wwwmaster / 194.217.48.42.

> It's clearly not a global problem, but I'm concerned that 2 ppl have
> reported something similar. I did just have a thought though - we had a
> problem on a similar box some time ago routing through broken ecn
> (explicit congestion notification) enabled routers. The fix in that case
> was to disable ecn on the server. I've just done this on wwwmaster -
> could you try it again in case that was it please?

Didn't help. :[

"Dave Page" <dpage@vale-housing.co.uk> writes:
> Can you ping and traceroute to demon-gw.vale-housing.co.uk? That's the
> upstream router...

FWIW, from here 194.217.48.42 responds to ping, but traceroute cuts off
at the upstream --- maybe that's what you expect.

$ traceroute 194.217.48.42
traceroute to 194.217.48.42(194.217.48.42), 30 hops max, 20 byte packets
 1 router1.sss.pgh.pa.us (192.168.168.5)          1 ms   1 ms   1 ms
 2 192.168.252.29 (192.168.252.29)                5 ms   5 ms   5 ms
 3 gateway.aspStation.net (66.207.128.1)          4 ms   4 ms   4 ms
 4 130.94.199.253 (130.94.199.253)                6 ms   6 ms   6 ms
 5 ge-2-3-0.a04.pitbpa05.us.ra.verio.net (129.250.24.118)   6 ms   6 ms   6 ms
 6 p16-1-0-1.r21.asbnva01.us.bb.verio.net (129.250.16.30)  25 ms  11 ms  11 ms
 7 p16-0.sprint.asbnva01.us.bb.verio.net (129.250.9.54)  11 ms  12 ms  11 ms
 8 sl-st20-ash-12-0.sprintlink.net (144.232.19.240)  11 ms  12 ms  11 ms
 9 sl-bb23-rly-5-0.sprintlink.net (144.232.20.153)  21 ms  13 ms  13 ms
10 sl-bb21-rly-9-0.sprintlink.net (144.232.14.133)  34 ms  13 ms  13 ms
11 sl-bb20-tuk-1-0.sprintlink.net (144.232.20.121)  25 ms  25 ms  25 ms
12 sl-bb21-tuk-15-0.sprintlink.net (144.232.20.133)  17 ms  20 ms  18 ms
13 sl-bb21-lon-14-0.sprintlink.net (144.232.19.70) 103 ms  88 ms  88 ms
14 sl-gw10-lon-15-0.sprintlink.net (213.206.128.46)  88 ms  88 ms  88 ms
15 sle-thuspl-1-0.sprintlink.net (213.206.156.54)  90 ms  90 ms  90 ms
16 anchor-backbone-11-294.router.demon.net (194.70.98.58)  92 ms  92 ms  92 ms
17 rea1-bstdx-1.router.demon.net (194.159.7.71)  97 ms  97 ms 109 ms
18 demon-gw.vale-housing.co.uk (194.217.48.33)   96 ms  95 ms  96 ms
19 * * *
20 * * *
21 * * *
22 * * *

            regards, tom lane

> -----Original Message-----
> From: Tom Lane [mailto:tgl@sss.pgh.pa.us]
> Sent: 17 January 2005 22:59
> To: Dave Page
> Cc: Michael Paesold; Josh Berkus; PostgreSQL WWW Mailing List
> Subject: Re: [pgsql-www] Fwd: [pgsql-advocacy] Website: links
> to wwwmaster.postgresql.org don't work for me
>
> "Dave Page" <dpage@vale-housing.co.uk> writes:
> > Can you ping and traceroute to demon-gw.vale-housing.co.uk?
> That's the
> > upstream router...
>
> FWIW, from here 194.217.48.42 responds to ping, but
> traceroute cuts off
> at the upstream --- maybe that's what you expect.

Yes, entirely - in fact I can see the firewall dropping UDP packets from
sss.pgh.pa.us:

Jan 17 22:57:21 net2all:DROP:IN=eth0 OUT= SRC=66.207.139.130
DST=194.217.48.42 LEN=48 TOS=0x00 PREC=0x00 TTL=4 ID=52521 PROTO=UDP
SPT=44784 DPT=33500 LEN=28

I have just noticed a few of these go though:

Jan 17 23:05:41 newnotsyn:DROP:IN=eth0 OUT= SRC=201.246.86.173
DST=194.217.48.42 LEN=52 TOS=0x08 PREC=0x00 TTL=42 ID=52338 DF PROTO=TCP
SPT=1079 DPT=80 WINDOW=16024 RES=0x00 ACK FIN URGP=0

The comment in the config file says:

TCP packets that don't have the SYN flag set and which are not part of
an established connection will be accepted from this interface, even if
NEWNOTSYN=No has been specified in /etc/shorewall/shorewall.conf.

NEWNOTSYN was set to No, I've just changed it to Yes - Alexey, Michael;
any difference?

Regards, Dave.

> -----Original Message-----
> From: pgsql-www-owner@postgresql.org
> [mailto:pgsql-www-owner@postgresql.org] On Behalf Of Dave Page
> Sent: 17 January 2005 23:15
> To: Tom Lane
> Cc: Michael Paesold; Josh Berkus; PostgreSQL WWW Mailing List
> Subject: Re: [pgsql-www] Fwd: [pgsql-advocacy] Website: links
> to wwwmaster.postgresql.org don't work for me
>
>
> NEWNOTSYN was set to No, I've just changed it to Yes -
> Alexey, Michael;
> any difference?

The firewall was also blocking connections from IANA reserved address
blocks - unfortunately it seems it's list was a little out of date and
included a couple of blocks that have since been released to other
registries. I've disabled that rule altogether now as it was blocking at
least one user tonight.

Regards, Dave.

Didn't help me either.  When I select one of the mirrors, now only 4 US mirrors are showing up, I am redirected to
wwwXX.us.postgresql.org

Traceroute attached.

On Tue, Jan 18, 2005 at 01:18:30AM +0300, Alexey Borzov wrote:
> Hi,
>
> I have the same problem connecting to wwwmaster from home...
>
> Dave Page wrote:
> >Can you ping and traceroute to demon-gw.vale-housing.co.uk? That's the
> >upstream router...
>
> Yes, I can.
>
> But I can't ping / traceroute / connect to wwwmaster / 194.217.48.42.
>
> >It's clearly not a global problem, but I'm concerned that 2 ppl have
> >reported something similar. I did just have a thought though - we had a
> >problem on a similar box some time ago routing through broken ecn
> >(explicit congestion notification) enabled routers. The fix in that case
> >was to disable ecn on the server. I've just done this on wwwmaster -
> >could you try it again in case that was it please?
>
> Didn't help. :[
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 2: you can get off all lists at once with the unregister command
>    (send "unregister YourEmailAddressHere" to majordomo@postgresql.org)

Hi,

Dave Page wrote:
>>NEWNOTSYN was set to No, I've just changed it to Yes -
>>Alexey, Michael;
>>any difference?
>
> The firewall was also blocking connections from IANA reserved address
> blocks - unfortunately it seems it's list was a little out of date and
> included a couple of blocks that have since been released to other
> registries. I've disabled that rule altogether now as it was blocking at
> least one user tonight.

Dunno which fix did it, but right now I'm able to open wwwmaster. Thanks, Dave!

> -----Original Message-----
> From: Michael Paesold [mailto:mpaesold@gmx.at]
> Sent: 18 January 2005 07:20
> To: Dave Page; Josh Berkus; PostgreSQL WWW Mailing List;
> pgsql-advocay@postgresql.org
> Subject: Re: [pgsql-www] Fwd: [pgsql-advocacy] Website: links
> to wwwmaster.postgresql.org don't work for me
>
>
> "Dave Page" <dpage@vale-housing.co.uk> wrote:
> > Can you ping and traceroute to demon-gw.vale-housing.co.uk? That's
> > the upstream router...
>
> Yes, I was able to ping that all the time. It was the last
> hop I could see
> in a traceroute to wwwmaster.

Yeah, just trying to confirm where the problem was exactly.

> I can now ping, traceroute, connect to port 80 with telnet
> and, yes, view
> the page in my webbrowser. I am still at home (after a night
> of sleep) and
> have not changed anything here, by the way. So it seems that
> ecn could be
> the problem.

Based on Alexey's report, it wasn't ecn. My bet is on the firewall's
rfc1918 blocking which for some unknown reason not only blocked private
class addresses, but any /8 block listed by IANA as reserved.
Unfortunately, the list was out of date :-( Anyway, I've disabled that
feature altogether now just to be on the safe side.

Out of interest, what is your IP (or just the network if you prefer)?

> Is there any reason why you would not want to disable the feature?

Not for me.

Thanks for testing.

Regards, Dave.

"Dave Page" <dpage@vale-housing.co.uk> wrote:
> Can you ping and traceroute to demon-gw.vale-housing.co.uk? That's
> the upstream router...

Yes, I was able to ping that all the time. It was the last hop I could see
in a traceroute to wwwmaster.

> It's clearly not a global problem, but I'm concerned that 2 ppl
> have reported something similar. I did just have a thought though -
> we had a problem on a similar box some time ago routing through
> broken ecn (explicit congestion notification) enabled routers.
> The fix in that case was to disable ecn on the server. I've just
> done this on wwwmaster - could you try it again in case that was
> it please?
>
> Regards, Dave.

I can now ping, traceroute, connect to port 80 with telnet and, yes, view
the page in my webbrowser. I am still at home (after a night of sleep) and
have not changed anything here, by the way. So it seems that ecn could be
the problem.

Is there any reason why you would not want to disable the feature?

Best Regards,
Michael Paesold

> -----Original Message-----
> From: Michael Paesold [mailto:mpaesold@gmx.at]
> Sent: 18 January 2005 07:27
> To: Dave Page; Tom Lane
> Cc: Josh Berkus; PostgreSQL WWW Mailing List
> Subject: Re: [pgsql-www] Fwd: [pgsql-advocacy] Website: links
> to wwwmaster.postgresql.org don't work for me
>
> My IP address was 83.64.153.60, when I wrote the mail. It's a
> dynamically
> assigned one. Now it's 83.64.76.36. The block seems to be wrong, yes.

That explains it - 83.x.x.x is one of the blocks that became
un-reserved. Brain-dead bloody firewall....

/D

Dave Page wrote:
>
> The firewall was also blocking connections from IANA reserved address
> blocks - unfortunately it seems it's list was a little out of date
> and included a couple of blocks that have since been released to
> other registries. I've disabled that rule altogether now as it was
> blocking at least one user tonight.
>
> Regards, Dave.

Well, now I can't say which change caused the problem to go away. As stated
in my other email, it works now, but now is after all the changes. Perhaps
you can take one back?

My IP address was 83.64.153.60, when I wrote the mail. It's a dynamically
assigned one. Now it's 83.64.76.36. The block seems to be wrong, yes.

Best Regards,
Michael Paesold

Dave Page wrote:

> That explains it - 83.x.x.x is one of the blocks that became
> un-reserved. Brain-dead bloody firewall....
>
> /D

:-)

Thanks for investigation. I'm happy the issue has been resolved (on behalf
of all blocked users).

Michael