fedora-infrastructure

#7924 Connection to fedorapeople.org fails for some of the IP ranges from RHs internal network
Closed: Fixed by kevin. Opened by mvadkert.

Closed: Fixed
Reopen Issue

We are accessing some data from fedorapeople.org from RHs internal network, but for some IP ranges we cannot connect. The traceroute ends somwhere in NCREN. We are not sure why this happens, but it is weird. Note that the gateway is the same in both occassions ....

According to traceroute the packets are dropped somewhere in NCREN

# tracepath -n 152.19.134.199
 1?: [LOCALHOST]                                         pmtu 1500
 1:  <some-address>                                    6.636ms
 1:  <some-address>                                    7.952ms
 2:  <some-address>                                   10.924ms
 3:  <some-address>                                    0.732ms
 4:  <some-address>                                   12.053ms
 5:  <some-address>                                54.624ms
 6:  <some-address>                                 24.366ms
 7:  66.187.233.252                                       33.301ms asymm  8
 8:  209.132.190.199                                      19.711ms
 9:  209.132.190.191                                      19.766ms
10:  24.142.212.201                                       20.977ms asymm  9
11:  24.25.62.50                                          26.623ms asymm 22
12:  24.93.64.186                                         30.103ms asymm 21
13:  24.93.64.27                                          25.667ms asymm 19
14:  24.74.247.65                                         28.618ms
15:  24.172.68.239                                        27.124ms asymm 16
16:  98.101.20.135                                        26.877ms
17:  24.172.64.46                                         27.952ms asymm 18
18:  128.109.9.22                                         28.355ms asymm 19
19:  128.109.1.90                                         31.912ms asymm 20
20:  no reply
21:  no reply
22:  no reply
23:  no reply
24:  no reply
25:  no reply
26:  no reply
27:  no reply
28:  no reply
29:  no reply
30:  no reply
     Too many hops: pmtu 1500
     Resume: pmtu 1500

From some other machine the connection it works:

# tracepath -n 152.19.134.199
 1?: [LOCALHOST]                                         pmtu 1500
 1:  <some ip address>                              3.185ms
 1:  <some ip address>                                1.111ms
 2:  <some ip address>                               0.824ms
 3:  <some ip address>                             17.704ms
 4:  <some ip address>                             12.212ms
 5:  66.187.233.252                                       17.379ms
 6:  209.132.190.198                                      21.494ms
 7:  24.142.212.201                                        0.825ms
 8:  24.142.212.201                                        0.778ms asymm  7
 9:  24.172.67.76                                          4.381ms asymm 12
10:  24.25.62.50                                           7.031ms asymm 19
11:  24.93.64.186                                         11.237ms asymm 18
12:  24.74.247.99                                         14.710ms asymm 13
13:  24.172.68.245                                         6.659ms
14:  98.101.20.135                                         6.394ms
15:  24.172.64.46                                          7.914ms
16:  24.172.64.46                                          8.055ms asymm 15
17:  128.109.1.90                                         12.917ms
18:  128.109.1.90                                         12.911ms asymm 17
19:  152.2.255.66                                         12.433ms asymm 18
20:  152.2.255.166                                        12.681ms asymm 19
21:  152.19.134.199                                       13.047ms !H
     Resume: pmtu 1500

Note that the site where fedorapeople.org is hosted, does have a IDS thing. If you do too many invalid ssh attempts from an IP, it blocks that IP from being able to to connect to ANY resources for a bit (I think it's a day? or perhaps two).

Is the external IP both these nets are coming from the same? Or different?

@kevin thanks for the info. Our gateway IP for both these attempts is the same, i.e. 66.187.233.252. So I guess that is not it?

If the http://icanhazip.com/ is the same reported from both... then yeah... no that.

I do note that fedorapeople.org has a ipv6 address. Could it be that some people are getting non routable ipv6 addresses and others not? Or does this happen with ipv4 ?

@kevin according to traceroute logs, we're safely within IPv4 space.

ok. I am really not sure where to go here. Perhaps you could ask RH networking folks to talk to NCREN?

So if working and non working are using the same ip, it's not ip filtering, there must be something else about the failing connection.

Does it happen to any other sites?

Metadata Update from @kevin:
- Issue priority set to: Waiting on Assignee (was: Needs Review)

Any news here? Is this still happening?

Any news? Can we engage RH networking folks?

Metadata Update from @mvadkert:
- Issue close_status updated to: Insufficient data
- Issue status updated to: Closed (was: Open)

Sorry for the late response. We do not see this problem now. Will try with RH networking folks if it pops up again, thanks.

Metadata Update from @mvadkert:
- Issue status updated to: Open (was: Closed)

Metadata Update from @kevin:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.