This is a new install of Centos7.3. I have a static IP in the same range as my other machines, I can ping or ssh from this machine to others, it sees my name server and uses it for dns, it uses autofs correctly to mount network home, but I cannot ping it or ssh to it. I turned off firewall (systemctl stop firewalld) I made sure to echo "0" to /proc/sys/net/ipv4/icmp_echo_ignore_all (and _broadcasts just to hit twice), and I made sure (with ifconfig) that I was sending / receiving correctly and that my netmask, gateway, and IP are all exactly as they are on the other machines (except for IP of course). SELinux is disabled. I'm stumped. Any help appreciated.

  • 1
    Have you run tcpdump on the interface while trying to ping or ssh to this machine? Are you trying to access using its IP or hostname? Both? – Deathgrip Jun 7 '17 at 19:30
  • I'll try that, and/or wireshark on the interface. It feels like the firewalld did not actually die, that is something else I will check. (by looking for the process). – billmenger Jun 8 '17 at 20:59
  • Don't forget, the firewall will start on reboots unless you systemctl disable firewalld. – Deathgrip Jun 8 '17 at 21:13
  • I have now verified that firewalld is not running after boot (disabled it and removed link). I installed iptables and set up default rules that would allow ssh and ping from anyone. selinux is disabled. tcpdump output from another workstation in the subnet shows ARP requests "IPv4 (len 4), Request who-has xxx tell yyy, length 46" when attempting to ping or ssh to the machine. GATEWAY, NETMASK, IPADDR all are good and consistent with the subnet. DNSMASQ is used to resolve names and seems to be working flawlessly. I am still stumped. Thanks @Deathgrip, appreciate the advice! – billmenger Jun 12 '17 at 15:00

All the above checks are good, but one final check solved the problem. in the /etc/hosts and the /etc/sysconfig/network-scripts/ifcfg-en9p0 files, I had accidentally typed one digit off on the IPADDR for the machine. Stupid mistake. I put a 221 instead of a 121, and 221 was also the address of a machine that was in the tables but turned off. So that explains how I could get OUT but not IN.

So for a very secure machine, tell it it has the IP of a down'ed machine and tell your DNS server it has a different address. No one will be able to get in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.