Issue IP failover not reacheable from Vodafone, Ho Mobile, and other cellular connections

[jonium]

Hello,
I have a strange problem with one Windows server.
The main IP of the server is a dedicated one, not connected to any hostname.
I configured an IPFO as alias and shared it among the domains hosted.

Some clients using Vodafone connections (mobile) and other Mobile connections can't reach those domains.
I bought bought to do some tries and notice that if I ping first a domain of those I can't reach it but after pinging the main IP I can reach all other of those domains too...
How to fix it?

Server Windows Server 2016
Plesk Obsidian 18.0.39

 

[Nik G]

hello @jonium ,

what is the output of "ipconfig /all" and "route print" commands when you can't reach your sites ?
I mean is configured alias is present in system configuration?

is your server available by alias ip (not by hosted domain name) when such circumstances happen ?

have you checked is alias present in IIS > domain > bindings (for couple hosted domains that are unreachable) ?


is this problem affects only mobile connections and from land-line operators everything works as expected or land-lines affected too ?

 

[jonium]

Hello Nik,
I'll try to explane you the complete situation.

Here is the content of the Plesk page IP Addresses (/admin/ip-address/list/):

IP address Interface IP type Resellers Sites
213.32.108.231 /255.255.255.255 "Ethernet" Shared 2 120
5.39.73.187 /255.0.0.0 "Ethernet" dedicated 0 0
54.36.11.94 /255.255.255.255 "Ethernet" Shared 1 1

The main IP of the server, assigned by the farm is 5.39.73.187.
Here are the commands you required when sites are unreacheable:

C:\>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : ******
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Ethernet:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) I210 Gigabit Network Connection
Physical Address. . . . . . . . . : A4-BF-01-44-48-A1
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::f15d:7bba:f67b:b00d%4(Preferred)
IPv4 Address. . . . . . . . . . . : 5.39.73.187(Preferred)
Subnet Mask . . . . . . . . . . . : 255.0.0.0
IPv4 Address. . . . . . . . . . . : 54.36.11.94(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.255
IPv4 Address. . . . . . . . . . . : 213.32.108.231(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . : 5.39.73.254
DHCPv6 IAID . . . . . . . . . . . : 61128449
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-24-AE-AE-42-A4-BF-01-44-48-A1
DNS Servers . . . . . . . . . . . : 213.186.33.99
NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{3A6E91E8-E82A-4AE4-9506-45644F98372C}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:0:2851:782c:24b8:a02:fad8:b644(Preferred)
Link-local IPv6 Address . . . . . : fe80::24b8:a02:fad8:b644%2(Preferred)
Default Gateway . . . . . . . . . : ::
DHCPv6 IAID . . . . . . . . . . . : 167772160
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-24-AE-AE-42-A4-BF-01-44-48-A1
NetBIOS over Tcpip. . . . . . . . : Disabled


C:\>route print
===========================================================================
Interface List
4...a4 bf 01 44 48 a1 ......Intel(R) I210 Gigabit Network Connection
1...........................Software Loopback Interface 1
3...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
2...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 5.39.73.254 5.39.73.187 281
5.0.0.0 255.0.0.0 On-link 5.39.73.187 281
5.39.73.187 255.255.255.255 On-link 5.39.73.187 281
5.255.255.255 255.255.255.255 On-link 5.39.73.187 281
54.36.11.94 255.255.255.255 On-link 5.39.73.187 281
127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
213.32.108.231 255.255.255.255 On-link 5.39.73.187 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
224.0.0.0 240.0.0.0 On-link 5.39.73.187 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
255.255.255.255 255.255.255.255 On-link 5.39.73.187 281
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 5.39.73.254 Default
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
2 331 ::/0 On-link
1 331 ::1/128 On-link
2 331 2001::/32 On-link
2 331 2001:0:2851:782c:24b8:a02:fad8:b644/128
On-link
4 281 fe80::/64 On-link
2 331 fe80::/64 On-link
2 331 fe80::24b8:a02:fad8:b644/128
On-link
4 281 fe80::f15d:7bba:f67b:b00d/128
On-link
1 331 ff00::/8 On-link
4 281 ff00::/8 On-link
2 331 ff00::/8 On-link
===========================================================================
Persistent Routes:
None


>>>is your server available by alias ip (not by hosted domain name) when such circumstances happen ?
No, if I ping the alias IP 213.32.108.231 from a Vodafone connection I get all the packets lost

>>>have you checked is alias present in IIS > domain > bindings (for couple hosted domains that are unreachable) ?
Here is a screenshot


I bought a Vodafone SIM in order to do the tests because obviously I can't ask my clients to do them...
I'm not secure about all connections but it seems that mainly mobile connections are affected, I know about Vodafone Italy, Ho Mobile (sub of Vodafone) and a Hetzner server's IP of a client of mine.
Most other connections, especially land-lines ones, appear to be working normally.

Thanks for your help

 

[jonium]

Maybe the problem is this??

 

[Nik G]

hello @jonium ,

regarding your last screenshot with warning at IIS configuration:

no, it should not be a reason because in this case server will be available via IP (let's say conections at port 3389, 25 and so on) but return wrong content via http(s) (from IIS).

however, you said that it is not available by alias IP at all.



It looks like something wrong at your server with routing in general. I'd recommend you to submit ticket with all those details to your hosting provider.

for now it looks as not a Plesk-related problem, but network administration in OS.

 

[jonium]

Does IP routing need to be enabled?

 

[jonium]

I have a bit of experience, managing myself servers Windows and Linux and I followed the OVH instructions in order to add the IPFO at server initial configuration. After having communicated the problem by ticket they asked me to do some tests of reacheability of the IPFO in rescue mode to exclude any configuration issue of my end and the IPFO was reacheable...

 

[Nik G]

@jonium ,
I'm right that IPFO works as expected after server reboot.
But after some time it stopped to work in a way described you above ?
or after reboot the problem is still exists until some actions from your side?

are you able to check, will ipfo work for ~the same period in safe mode or it will became failt too?

is this problem exists from the beginning (since you have this server installed) or it started to appear some time ago ?

 

[jonium]

The problem exist from the beginning, I installed Plesk and put an IPFO as main Plesk IP (shared)

 

[jonium]

The problem exist from the beginning, I installed Plesk and put an IPFO as main Plesk IP (shared)

or is it mandatory to put as main ip the initial IP of the server provided by the farm (not IPFO)?

 

[jonium]

If I try to connect (whith Firefox) to a site hosted on the server with the IPFO I get:

Secure Connection Failed

An error occurred during a connection to www.xxxxxxxx.it. PR_CONNECT_RESET_ERROR

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.

Secure connection failed and Firefox did not connect | Firefox Help

I get this message only from Vodafone connections
and the IPFO is unreacheable at ping too...
(always from Vodafone connection)

 

[Nik G]

hello @jonium

or is it mandatory to put as main ip the initial IP of the server provided by the farm (not IPFO)?

for me it does not look reasonable.

did you able to check the below:

are you able to check, will ipfo work for ~the same period in safe mode or it will became fail too?

?


one more thought here:
seems your current network configuration mostly works (at least by land-line providers).
then probably the problem can be at Vodafone side?
maybe you need to contact Vodafone support ?