Ping not working

[JohnAaronRose]

When i try to ping my ip address as shown as shown in the 'Internet Connectivity' admin web page all packets get lost. Why is that?

[KeithFrench]

You do not have a problem at all then.

I have explained about the pitfalls of NAT Loopback quite a few times during this thread.

How do you allow NAT Loopback - simple, you can't. TalkTalk blocks this to prevent some potential security attacks. What you need to do is access the webserver locally via its private IP address on your own LAN.

[JohnAaronRose]

I tried point 4 first: switching wifi off on my phone and using index.html (and others) using Firefox on my phone. Web server responded correctly. So this is the solution and therefore no need 'send' you wireshark output or router screenshots. I presume that I would be able to connect properly to my web server if I was away from home using somebody else's wifi.
I presume that the problem is NAT loopback (on my LAN) which is new to me. I looked it up and the description is:
"NAT loopback... where a machine on the LAN is able to access another machine on the LAN via the external IP address of the LAN/router (with port forwarding set up on the router to direct requests to the appropriate machine on the LAN). Without NAT loopback you must use the internal IP address of the device when on the LAN.".
How do you allow NAT loopback?
https://portchecker.com shows that ports 80 & 443 are both open on the address of the TT router.

[KeithFrench]

I @henryhawthort 

As I said elsewhere in this thread I proved that NAT Loopback is not affecting any ICMP PING traffic, but will block any genuine IP traffic if tested in that manner.

I also asked that if you need help, please create your own thread. It is TalkTalk who insists on this, not me.

[KeithFrench]

Hi @JohnAaronRose 

Please can you:-

1. Working with a text file from Wireshark is not really possible, please get me a trace file as I requested. To do this just go to Wireshark's File menu & choose "Save As" and save it as a"pcapng" file. Zip that up & attach it to your post. I will then download it & remove your attachment to preserve your privacy (as I will for your text file).
2. Include screenshots of all port forwarding rules & IP address allocation on both the 5364 & TP-Link router, so I can check them.
3. Have you tried going to a port-checking website such as https://portchecker.co/ - do the HTTP & HTTPS ports report as Open or Closed?
4. How have you been testing this previously, as there is every chance that you are falling foul of NAT Loopback? The best way is to disconnect a smartphone from your WiFi and use mobile data to try to connect to your web server.

[JohnAaronRose]

IP interfaces involved in Port Forwarding are DHCP reserved. TT router (192.168.1.1) Port Forwards 80 & 443 to 192.168.1.10 which is TPL router. TPL router (192.168.2.1) Port Forwards 80 & 443 to Pi (which is 192.168.2.10).

I don't see any Trace option in wireshark. Perhaps it's due to the XDG_RUNTIME_DIR below:

manager@Server:~ $ sudo wireshark -i eth0 -k
10:12:57.265 Main Warn QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to '/tmp/runtime-root'
error: XDG_RUNTIME_DIR not set in the environment.
10:12:58.272 Main Warn QXcbConnection: XCB error: 148 (Unknown), sequence: 192, resource id: 0, major code: 140 (Unknown), minor code: 20

So I've copied all of the outputted messages (after trying my web server's index.html in Firefox) to clipboard and saved them in a file which I've attached.

[KeithFrench]

Due to the vast information that a Wireshark trace contains, a screenshot is of no use. Please save it as a trace, zip it up & attach it to your thread.

Are all IP interfaces involved in the port forwarding still correct, are they static or DHCP reserved addresses?

[JohnAaronRose]

I've installed wireshark on my Pi.. Running it on my wired interface (eth0) on the Pi shows that there is no tcp (or even udp) messages for the wired interface from my TP-Link router to the Pi. Strangely, even though I selected a directory on my Pi. So I've attached a screenshot of wireshark showing the messages. Please ignore the VNC ones and the TCP 5900 & 49024 ones as I control the Pi from my Desktop using VNC. 192.168.2.10 is the reserved NAT address for my Pi. I don't see 192.168.2.108 on my TP-Link router's DHCP Client List.

I don't see any way that I can check the messages to & from the TalkTalk Sagem router or to & from my TP-Link router. Any ideas on that?
PS I misinformed earlier about the response for my web site: I didn't get a 404 but eventually a timeout.

[gmlack]

"...gets a 404 when it used to work before..."

A 404 implies that it got to a Web server somewhere. Inability to get to a server would surely result in a timeout.

[KeithFrench]

How are you testing this? It is highly likely that after your upgrade you have a new WAN IP address, but then I guess you have taken that into account by trying to ping it. Does your Raspberry Pi support Wireshark or any other pcap capture tools?

[JohnAaronRose]

The TalkTalk's Sagem 5364 router has WiFi turned off with only one Wired RJ45 connection to my TP-Link router and all services required (e.g. 80 & 443) Port Forwarded to my TP-Link router. The TP-Link router has all required services (e.g. 80 & 443) Port Forwarded to my Raspberry Pi. My Raspberry Pi has all required services (e.g. 80 & 443) allowed in ipTables i.e. no change from when it worked pre-Fibre.   

[gmlack]

You can find your external address by visiting:

https://myexternalip.com/

which will display it at the top.

As for serving up you own web pages, you'll need to set up port mapping to get through your router.
And if you want to use a name (rather than a - changing - IP address) you'll need to use a service such as DynDNS, No-IP (there are lots of them...look for Dynamic DNS services).

[KeithFrench]

That is a different issue altogether. Have you set up the required port forwarding in the router (don't touch its firewall)? Then, if it has one, you will need to allow these ports through any firewall on the Raspberrey Pi?

[JohnAaronRose]

As I said before, "I'm not really concerned so much by the Ping not 'found' of the Router's public IP address as my home web site (on an attached Raspberrey Pi) gets a 404 when it used to work before this Fibre upgrade. So, how do I get my web server to serve up web pages?

[KeithFrench]

The internet is made up of goodness knows how many routers, some within TalkTalk's network, some belonging to other ISPs and the backbone that makes up the internet. Any one of these 1000's of routers could be blocking PINGs. NAT Loopback refers to your 5364 router.

Sorry, but there is nothing that you can do about this at all.

[JohnAaronRose]

I don't understand about the router. Presumably you mean a router in TalkTalk's own network (rather my LAN as attached to TalkTalk's Sagem 5364 router which is in my property).

As I said before, "I'm not really concerned so much by the Ping not 'found' of the Router's public IP address as my home web site (on an attached Raspberrey Pi) gets a 404 when it used to work before this Fibre upgrade. So How to get my web server to serve up web pages?

[KeithFrench]

As I said it is either down to a router in the TalkTalk network blocking them, before they arrive back at your router or NAT Loopback.

[JohnAaronRose]

I'm on FTTC not FTTP: so not full fibre. Homes in my town (Wolverhampton) are currently being upgraded this way.
 I still don't understand why "Even when I modify the Firewall in the Sagem 5364 Router: 'Respond to Ping' to On and Level to Medium, ping still does not 'find' the Public IP Address ( 92.30.75.195). Why is that?".

I'm not really concerned so much by the Ping not 'found' of the Router's public IP address as my home web site (on an attached Raspberrey Pi) gets a 404 when it used to work before this Fibre upgrade.

[KeithFrench]

Hi @henryhawthort 

If you want help, you cannot use someone else's thread.

To get help, you must start your own thread. To create your own thread, go to the main page for the board in question & click the "Start a topic" button.

TalkTalk insists on one thread per problem per customer. Please note, TalkTalk makes the rules, not me.

Thanks.

[KeithFrench]

It is very common for any router or firewall to block PINGs these days. It is probably something to do with the full fibre network that you are on.

[JohnAaronRose]

Even when I modify the Firewall in the Sagem 5364 Router: 'Respond to Ping' to On and Level to Medium, ping still does not 'find' the Public IP Address ( 92.30.75.195). Why is that?

Before I had Fibre (upgraded in last week), broadband was done by copper line all the way from the Cabinet to the Property and ping worked OK.