Can't get DNS to work on web server
from dr_robotBones@reddthat.com to selfhosted@lemmy.world on 12 Jun 01:25
https://reddthat.com/post/43377840

I’m trying to self host my portfolio on an old laptop running Ubuntu server. I’ve successfully set up docker and nginx. I got a DNS subdomain from freedns.afraid.org.

The IP connected to the DNS matches my server’s public IP address.

I can connect with mypublicip from outside the network, but it shows as an insecure connection and the https has lines going through it in the browser.

Any attempts to connect to the website via DNS have failed, and trying to connect via IP on port 80 fails as well. I really have no clue what is going on, let me know if you need more information, or if this is the wrong place to ask for help with this sort of thing.

Edit: Whatever problem I had before, it seems its been fixed. However my subdomain is being blocked by ISPs. Thank you for the help everyone, I’ll probably have to do cloudflare tunneling instead of fully self-hosting it.

#selfhosted

threaded - newest

SnotFlickerman@lemmy.blahaj.zone on 12 Jun 01:34 next collapse

Have you set up certificates with LetsEncrypt or something similar?

Since you’re running it on your own hardware and obviously have admin privileges, you could try out Certbot:

certbot.eff.org

HTTPS requires signed certificates to be able to connect, that’s part of the trust provided in the security. Also, HTTPS is port 443 while HTTP is port 80.

osaerisxero@kbin.melroy.org on 12 Jun 06:11 next collapse

This is likely correct but the browser's errors should be telling you what the error(s) is/are.

dr_robotBones@reddthat.com on 12 Jun 09:50 collapse

The error was: ERR_CONNECTION_TIMED_OUT. I also got an ERROR_CONNECTION_REFUSED earlier.

dr_robotBones@reddthat.com on 12 Jun 09:49 collapse

Yes, that’s what I did.

solrize@lemmy.ml on 12 Jun 01:47 next collapse

The domain name in the certificate has to match the one in the browser. Does it? You haven’t said.

dr_robotBones@reddthat.com on 12 Jun 09:53 collapse

Yes it does.

Bort@hilariouschaos.com on 12 Jun 01:52 next collapse

I suggest you check out pangolin. For me it’s worth about $12/year to not have a domain pointing directly at my home network, but instead have a layer of privacy and security. Running geofilter and crowdsec is really nice. Sometimes my logs show more than one blocked connection attempt per second. Another option if you want a free service is cloudflared tunneling.

dr_robotBones@reddthat.com on 12 Jun 09:54 collapse

I did it this way because I didn’t think a randomly generated domain name from cloudflare would be professional enough. I might have to go with that if I can’t get this working though.

pezhore@infosec.pub on 12 Jun 06:31 next collapse

What does your nginx config look like for ssl? It should specify a certificate and key file - that certificate subject needs to match your fully qualified domain name (fqdn). Certificate can have subject alternative names (SAN) for other names and even IP addresses.

For instance, you could have a single certificate for foo.bar with a SAN for just foo and an IP SAN for 192.168.1.30.

Certificates also need to be signed by a certificate authority (CA), and in order for your browser to visit https://foo.bar/ without a warning your browser must trust that CA.

If you did a self signed cert, this is most likely the problem you’re running into.

It’s important to know that your communication is still encrypted because of SSL, but since your browser doesn’t trust the CA (or the subject doesn’t match the FQDN) the browser will say it’s not secure.

dr_robotBones@reddthat.com on 12 Jun 09:49 collapse

I can’t connect to the domain at all. I think the certificate problem was because I was connecting with the IP address rather than the domain name.

pezhore@infosec.pub on 12 Jun 11:01 collapse

Try this command from a terminal on the system from which you’re attempting to connect:

nslookup <yourfqdn>

It should come back with something like this:

~ ❯ nslookup stronk.bond
Server:         127.0.0.53
Address:        127.0.0.53#53

Non-authoritative answer:
Name:   stronk.bond
Address: 172.67.174.80

If it says something like “can’t find” that means that your dns isn’t configured appropriately. Does your IP address start with 192.168, 10., or 172.? That would be a private IP address (something which isn’t accessible from the internet.

Oh! And where is everything - is your workstation/laptop on the same network as your portfolio? Is the portfolio on a different network? That could effect things as well.

dr_robotBones@reddthat.com on 12 Jun 11:09 collapse

I get a 206 address that matches my server’s public IP. My laptop is on the same network as the portfolio, but I did test external connections using a mobile hotspot, which resulted in me successfully connecting to the IP address with telnet, but not being able to connect to the domain name. On my phone’s browser, while on data, I was able to access my portfolio website using the public IP address as the URL, rather than the domain name.

pezhore@infosec.pub on 12 Jun 11:53 collapse

Just to make sure.

  1. When on your home network, doing nslookup (or similar), your fqdn resolves to your public IP
  2. When on a hotspot, if you go to https://fqdn/ it does not connect (probably with the ERR_CONNECTION_TIMED_OUT that you mentioned below)
  3. When on hotspot, if you to telnet to port 443 on 206.x.x.x, it connects

What happens if you, on the hotspot, try browsing to https://206.x.x.x? When you are on the same network as the portfolio, can you reach https://[internal ip]?

What I’m leaning towards is a router/firewall that may be causing some issues. To help with troubleshooting, does your website server have any local firewalls (for ubuntu that would typically be ufw, but it could be iptables or firewalld)?

dr_robotBones@reddthat.com on 12 Jun 12:15 collapse

I don’t have any firewalls, and https://206.x.x.x and the internal IP one both worked.

pezhore@infosec.pub on 12 Jun 13:28 collapse

Okay, then I’m thinking your router/NAT maybe causing the problem. Typically, your ISP won’t block subdomains for dns, they may outright block Source NAT (SNAT), but if you could get through via the IP, you should be good to go.

catloaf@lemm.ee on 12 Jun 07:39 next collapse

How does it fail exactly? Surely there is some error message.

dr_robotBones@reddthat.com on 12 Jun 09:43 collapse

I get ERR_CONNECTION_TIMED_OUT when trying to connect to it. I don’t get any error logs on the server itself. I also got an ERROR_CONNECTION_REFUSED earlier.

catloaf@lemm.ee on 12 Jun 10:09 next collapse

And you’ve verified that the DNS record has the correct IP address? I would check the web server config to make sure it will respond to that name. See if there is anything in the access or error logs.

dr_robotBones@reddthat.com on 12 Jun 10:19 collapse

Yeah the DNS’ public IP matches my server’s. The access logs have some connections from the SSL validation and from when I successfully connected using the public IP address. The error logs are empty.

biscuitswalrus@aussie.zone on 12 Jun 13:40 collapse

If dns resolved then it’s not blocked. You need to look at your network.

Bypass dns connect to the ip and port. What happens?

ryan_harg@discuss.tchncs.de on 12 Jun 11:13 collapse

connection timeout doesn’t sound like ssl problem to me. is the webserver actually running? i think i read nginx in a different post, you might look for a running nginx process using

ps aux | grep nginx

If it is running, is the connection working with normal http:// on port 80?

dr_robotBones@reddthat.com on 12 Jun 11:25 collapse

I’ve done further testing with external network connections. I’m getting a Blocked hosts error, it seems my subdomain is being targeted by ISPs.

[deleted] on 12 Jun 08:52 next collapse

.

dr_robotBones@reddthat.com on 12 Jun 09:34 collapse

I got my SSL certs from running certbot. I don’t use DDNS.

signalsayge@infosec.pub on 12 Jun 10:39 next collapse

Is your firewall allowing port 443 (https) traffic?

dr_robotBones@reddthat.com on 12 Jun 10:45 collapse

I don’t think it is, but its hard to tell for sure.

pezhore@infosec.pub on 12 Jun 11:57 collapse

An easy way to check is to visit a site like this and check for port 443: www.yougetsignal.com/tools/open-ports/. You don’t need to be on the server that’s hosting your portfolio, just any thing that’s on the same network as your portfolio (something behind your external router)

maxwellfire@lemmy.world on 12 Jun 11:10 next collapse

If you do a DNS lookup (through nslookup or many other tools) on the client you’re using to connect, does it get the right IP back?

dr_robotBones@reddthat.com on 12 Jun 11:26 collapse

It does. I think my subdomain is being blocked by ISPs.

maxwellfire@lemmy.world on 12 Jun 11:30 collapse

In that case it’s highly unlikely your problem is with DNS. And much more likely it’s a problem with the actual connection to the server. If you are willing to share the IP/domain I can help troubleshoot (either here or in a DM).

mcchots@sh.itjust.works on 12 Jun 11:26 next collapse

It’s most likely that your external IP is resolving to your firewall and it’s not redirecting LAN traffic.

Either setup a redirect for LAN or setup a custom DNS entry on your router pointing to the server IP.

dr_robotBones@reddthat.com on 12 Jun 11:28 collapse

The external IP is properly bringing me to the portfolio, its just the subdomain that now seems to be blocked.

Jumuta@sh.itjust.works on 12 Jun 15:48 collapse

make sure ports 80 (htttp) or 443 (https) are unblocked on your server