Forum Moderators: phranque

Message Too Old, No Replies

cURL Connection Issues

Can't connect to IP:port from my server, but can from onlinecurl.com

         

StupidScript

11:09 pm on Oct 26, 2016 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



CentOS 6 (dedicated server)
SELinux disabled, and I can't find anything related in IPTABLES
cURL v.17.9.7

Summary: I can not use cURL (shell or PHP) to connect to this particular remote IP address from my server. Domain addresses and other IP addresses are fine, and I have no trouble connecting to the same problem IP address:port using any other method (ping, browsers, other cURL service, other networks, etc.)

For example:
curl http://www.google.com = fine
curl http://234.234.234.234:8888 (my own other server) = fine
curl http://123.456.234.234:8080 (the problem IP address) = "couldn't connect to host"
ping 123.456.234.234 = fine

Looking for: Anything more that I can look at to resolve this

Details (Suspicious Variation at the end):

My test shell command is:
curl http://123.456.234.234:8080

I use a real IP address with a print server running on it in a remote location.

Executing that command from my server shows:

* About to connect() to 123.456.234.234 port 8080 (#0)
* Trying 123.456.234.234...

and it never completes.

Executing essentially the same simple command from PHP (5.2 ... yeah, I know) using cURL:

$ch=curl_init();
curl_setopt($ch,CURLOPT_URL,"http://123.456.234.234:8080/");
curl_exec($ch);

times out with a "couldn't connect to host" cURL connection curl_error.

Executing the shell command from my home linux box pulls up the print server's page, immediately.

Executing the shell command from onlinecurl.com pulls up the print server's page, immediately.

Using any web browser to go to 123.456.234.234:8080 pulls up the print server's page, immediately.

On my server, connecting to a domain URL using cURL is no problem.

It seems to be having an issue only with IP addresses ... not ruling out ONLY this IP address, but it's all I have to work with.

I have tried:

My Server:
1) SELinux: installed, but disabled, therefore "setsebool -P httpd_can_network_connect on" does not execute.
2) IPTABLES: Did not find anything related to that IP address or that port in any of the tables.
3) /etc/hosts : set up "123.456.234.234 ppp.primarydomainonserver.com", and I can use either one, but no connection. I can ping the fake domain from that machine, and PHP cURL makes the translation, too ... but no cURL connect, either way.
4) Went through EVERY cPanel setting provided by the hosting company (not really a cPanel guy)

PHP cURL:
$httpheader = array(
"Host: ppp.primarydomainonserver.com"
);
curl_setopt($ch,CURLOPT_URL,"http://123.456.234.234:8080/");
curl_setopt($ch,CURLOPT_HEADER,1); (and false)
curl_setopt($ch,CURLOPT_HTTPHEADER,$httpheader);
curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);

and using or not using any and all of those.

Note that cURL v.17.9.7 does NOT include RESOLVE, but there doesn't seem to be a problem with that, if you look at the output of the shell test, above and nmap, below ... cURL's got the IP address, it just can't connect to the host.

Print Server: Windows 10, RocketShipIt Thermal Print Server
1) Windows Firewall: server is allowed (I can connect from anywhere) and my server does not match any firewall rule.
2) Windows Security: server is allowed with no restrictions, Private and Public networks

The routers where the print server is located have no firewalls or other control software.

Suspicious Variant:

nmap for a known-good, available HTTP server:port comes back:

nmap -p 80 234.234.234.234
Nmap scan report for www.realwebserver.com (234.234.234.234)
Host is up (0.032s latency).
PORT STATE SERVICE
80/tcp open http

nmap for this problem IP address:port comes back:

nmap -p 8080 123.456.234.234
Nmap scan report for ppp.primarydomainonserver.com (123.456.234.234)
Host is up (0.045s latency).
PORT STATE SERVICE
8080/tcp filtered http-proxy

Could this be affecting the installation of cURL on my server? It doesn't seem to have any affect on any other method I tested to connect.

Finale: I am seeking ANY thoughts on ANY systems/processes/etc. that might be affecting connection from that one server to that one IP address.

Thanks, in advance.

lammert

2:25 am on Oct 27, 2016 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



My first step would be to bypass all utilities and connect to the IP address directly with telnet. You may have to install telnet first with yum install telnet because the utility is not installed on CentOS 6 by default.

Give the command telnet 123.456.234.234 8080 and see if you get any response. If you don't get the below screen within a second, your problem is on the IP level. Otherwise your problem is curl related. Telnet does not do any protocol translation and just tells you what is happening on the connection.
Trying 123.456.234.234...
Connected to www.example.com.
Escape character is '^]'.

StupidScript

7:45 pm on Oct 27, 2016 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Thank you for your reply.

Telnet is, indeed, NOT able to connect to the print server from my server, and telnet IS able to connect from elsewhere.

Incidentally, lynx is in the same condition ... connects from elsewhere, just not my server.

The cable modem the target network uses is owned and managed by Charter Communications ... model: Ubee DDW-365.

I have been on the phone with them, all morning ... they tell me ...

"There is nothing in our line or equipment capable of blocking a single IP."
Ok ... thoughts?

"Port 8080 is blocked at the corporate level ... it is not open."
Hunh? I've been connecting to it from all over the world (Tor, etc.) for the past 3 days!

"Your Charter modem is badly misconfigured ... we must push it a new configuration!"
Nooooo!

"We have now opened port 8484, instead of port 8080."
Umm ... not "open" in a useful way ... it's actually WORSE! Now I can't get through the port from anywhere, using any service.

I did update our routers to use the new port forward ...

So, the next guy re-opened port 8080 ... nothing.

Nmap is still showing 8080 as STATE="filtered" and SERVICE="http-proxy"

Nmap shows 8484 as STATE="filtered" and SERVICE="unknown"

In order to even get that info, I now need to add -Pn to nmap to get around ping blocking. Didn't need to do that before.

Yes ... the new configuration pushed to the modem appears to have mucked things up real good.

Charter says, "Hey, it shows as open in the configuration ... that's all the troubleshooting we do." Bah!

I expect this thread is dead, as the situation has changed so much in the past couple of hours with the new configuration ... and I'll have a whole new set of crap to wade through to get it done.

Thanks, again, for your note.