Server went offline now none of my websites will load, they timeout.

[mdixon18]

I am running Plesk Version: 12.0.18 on CentOS.

Earlier today my service provider had a massive issue and my server was down for several hours. Upon it being back online i've restarted but now I cannot load any of my pages. I have 10 domains setup and if I ping their name servers or the server IP i get packets received now.

One of my installed domains is http://msdixon.co.uk now if you try and load this url you get a time out but if you try to access admin page https://msdixon.co.uk:8443 it loads...

None of the subscriptions are able to load their websites when i type in their URL and well it worked before it went down.

What's the issue?

 

[UFHH01]

Hi mdixon18,

please be aware that Plesk ( port 8443 is reachable as you stated ) uses its own, independent webserver. Your apache and/or nginx webserver are currently not reachable. Consider restarting them over Plesk, or over the command line ( ssh - login ) and try to investigate logs for the issues/problems:

Odin / Parallels Plesk Panel for Linux services logs and configuration files ( KB - article: 111 283 )​

Note: Please check as well https://www.ssllabs.com/ssltest/analyze.html?d=msdixon.co.uk , when you finished restarting apache and nginx. Your server is vulnerable and insecure.

 

[mdixon18]

I can't find any errors in the logs.

I have also restarted the services to no luck.

 

[mdixon18]

Unless [warn] RSA server certificate CommonName (CN) `Parallels Panel' does NOT match server name!? would cause it.

 

[mdixon18]

I tried restoring back 3 days, still no luck.

 

[UFHH01]

Hi mdixon18,

please check firewall - settings, iptables and SELinux - settings, just to make sure, that the needed ports aren't blocked and open.

Which ports need to be opened for all Plesk services to work with a firewall? ( KB - article 391 )​

 

[mdixon18]

UFHH01 i'm new to this software, can we get in touch off the forums and you help me at all?

Sorry if this inconveniences you.

Skype: matid1994
Or I can provide you with my email.

 

[Faris Raouf]

One of the problems you have is DNS. There are two nameservers associated with the domain, ns.msdixon.co.uk and slv2.1and1.co.uk

But somewhere there seems to be an ns1.msdixon.co.uk listed, and that's really confusing!
What's more, ns.msdixon.co.uk does not respond.

And there are no www records being returned from the other nameservers.

So there's more going on that meets the eye. Is slv2.1and1.co.uk really a nameserver, and does it really have records for your .co.uk domain?

I'm unable to do detailed lookups from where I am, but I think checking your DNS records and nameservers may be a good idea.

 

[mdixon18]

I don't understand it's worked for the past 6 months and ns.msdixon.co.uk as been working perfectly fine.

If i ping ns.msdixon.co.uk i get a response.

slv2.1and1.co.uk is what 1and1 tell us to have as our second name server when our primary name server points to our vps with plesk.

I just removed the ns1.msdixon.co.uk from the domains dns.

They domains themselves when ping are responding from the Plesk Server which is good news, so it must be something that's happened in plesk but i haven't touched anything. Everything broke yesterday after a DDoS attack on a container I share with.

 

[pleskpanel]

It's conceivable that your provider may have attempted to mitigate the DDoS attack by blocking port traffic on 80 and/or 443 which would actually support your results thus far (being able to login to Plesk but not being able to reach any of your sites despite restarting your node). It may not be advisable to continue with restores until you look at the firewall and if you don't see an issue you there, try asking your provider for advice on the right direction

 

[mdixon18]

Well plesk block port 80 in this case?

 

[pleskpanel]

It's not likely blocked by Plesk itself but rather the firewall running on your container (or possibly your provider's firewall). This is only a theory but it your comment regarding a recent DDoS seems to point to some action, very possibly from your provider, that was taken to mitigate that traffic. Try checking with them first to save on time (see if they proactively blocked traffic on 80 either at the node level, on a border router, or at the container level).

 

[Faris Raouf]

OK, things are slightly different today, it seems, but still not good and still confusing (to me, at least):
https://msdixon.co.uk connects (Glad you found me)
https://87.106.233.163 connects (same Glad you found me page)

There are still problems with your DNS though.
It is possible that it might be related to whatever is blocking other things, but I cannot get ns.msdixon.co.uk to respond from here (UK).
A third-party DNS test (US) does seem to be able to communicate with it, but it reports that ns.msdixon.co.uk does not have an NS record of ns.msdixon.co.uk - which isn't good.

In addition, attempting to do a lookup via slv2.1and1.co.uk results in a Refused for any record. Maybe you could check with them that this is really the correct secondary DNS to use?

dig @slv2.1and1.co.uk msdixon.co.uk A
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 33437

It is definitely time to talk to 1and1 support in more detail like pleskpanel suggests in order to figure out what on earth is going on. They should be able to point you in the right direction.

Another thing to check is the firewall on your machine, just in case. Look for a block on port 80 and possibly 53:
#iptables -v -n -L | less

 

[mdixon18]

Yes I can see the https works but not http on my domains which is really odd.

So I need to on msdixon.co.uk in plesk set a DNS record for ns.msdixon.co.uk and ns1.msdixon.co.uk and ensure my domain on my host points to both of these?

The command you put to run returned this result:

Chain INPUT (policy ACCEPT 1069K packets, 110M bytes)

pkts bytes target prot opt in out source destination


Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination


Chain OUTPUT (policy ACCEPT 192K packets, 31M bytes)

pkts bytes target prot opt in out source destination

 

[mdixon18]

Note if i try use my second name server as ns1.msdixon.co.uk it makes me insert an IP address which is the same to which it says: Please insert a unique IP address

 

[eilko]

according to the checks at http://mxtoolbox.com/domain/msdixon.co.uk/

the root DNS says that ns.msdixon.co.uk and slv2.1and1.co.uk should be the DNS servers. slv2.1and1.co.uk is not responding or refusing to give an answer. Contact 1and1 for that. Adding an ns1 in Plesk makes no sense as the root DNS doesn't know it.

Secondly port 80 is filtered by a firewall. Check the Plesk firewall in the addon section. Or contact 1and1 to see if they are filtering....

PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
53/tcp open domain
80/tcp filtered http
106/tcp open pop3pw
110/tcp open pop3
143/tcp open imap
443/tcp open https
465/tcp open smtps
993/tcp open imaps
995/tcp open pop3s
3306/tcp open mysql
8443/tcp open https-alt

 

[mdixon18]

Where do i find the firewall everyone is talking about in Plesk? I don't see it.

 

[pleskpanel]

If you aren't familiar with the Plesk firewall then it's possible that the filtering is taking place above the container or node level rather than on your virtual server itself. Contact your provider to see if this is the case

 

[eilko]

left menu -> extensions -> firewall

it might not be there as it is an optional add on. In this case it might be the standard Linux firewalling or your ports are filtered by the provider.

 

[mdixon18]

Oh yeah, I don't have firewall installed then i believe.

I'll contact my provider.