Internet becoming unavailable for all users

[ricky15100]

Hi all dont know if this is the correct section or not.

We host our own joomla 2.5 webserver using apache, throughout the day all my users lose connection to the internet, if i disable the webserver everyones connection becomes available again. Has anybody any ideas what might be happening?

[paulera]

Could you be more specific about the symptoms? When you do /etc/init.d/apache stop, your network users can access internet, and when you do /etc/init.d/apache start, they can't???

[ricky15100]

Thats correct, the moment i stop apache, the internet becomes available again instantly

[paulera]

Maybe it can be some IP conflict. You can use arp-scan to list all machines IPs and look for repeated entries:

Code: Select all

arp-scan --interface=eth0 --localnet

[drammar]

ok, I have a few ideas that might help you out.

Since it seems to revolve around apache, here is what I would like you to try:

1. Turn Apache back ON.
2. Block port 80 in your firewall.

Yes this will make your webserver unavailable but that is the intention. If your users can connect reliably like this, then Apache is not "sending out" data (which is a good thing). Now if you reopen port 80 on your firewall and the problem returns, well most likely you are being DoS'ed. You can check Apache's log files as well to see if a huge amount of repeat requests keep coming in.

If this were an IP address conflict, it would affect the entire network connection, not just port 80. Also check to see if you have mod_evasive installed for Apache as it can help to mitigate DoS attacks. An alternative would be to use conntrack and iptables to limit incoming connections per IP (if this turns out to be a DoS).

Also, you can use a tool called Etherape, which will give you a visual representation of all incoming and outgoing connections, what port or service they are using etc.

[paulera]

Now if you reopen port 80 on your firewall and the problem returns, well most likely you are being DoS'ed. You can check Apache's log files as well to see if a huge amount of repeat requests keep coming in.

Cool! It really makes a lot of sense! Thank you for the tip!

[ricky15100]

Thats excellent advise guys, ill try blocking port 80 dont know why i didnt think of it myself. ive checked and there is no ip confilct.

so ill give that a go today when internet access becomes available.

Thanks very much