Help! Its been 3 months.

[VioletVenom]

Ok I have a small medical transcription company, we were recently forced to move our servers from where they were housed and setup our own, I was scared and leary of this but we went with QWEST, as the local cable company for the area we housed our servers didnt have static ips, QWEST does.

Our setup consists of a DVI server, an FTP server, an email server, and 2 computers used as dns controllers, along with our Sonicwall firewall.

So we set everything up, call up our name registar to point to the new IPs etc, everything was fine about 24 hours later as everything was working well, most everyone was reset back up except for 3 transcriptionists.

Well these 3 people cannot connect period, they cannot ping (times out) we did trace routes, stops at my reserved gateway, and doesnt go through to the IP.

Through troubleshooting we have found one common factor, all 3 that cannot connect/ping etc have Comcast cable for an isp and all 3 have ips starting with a 24, so they all have 24.x.x.x ips etc.

I should also note that I also have Comcast for an isp but my IP starts with a 66 and I can connect fine.

I called Comcast and was originally told it was previous internet abuse issue, yet the tech support at Comcast is of the basic level, I try to explain the issue to them and they want me to reboot the modem and computer, try using ftp program, etc. the issue isnt connectivity to the internet, its to my servers, like I mentioned earlier they cannot ping or trace route or anything yet the tech support cannot seem to understand this.

Things I have tried, I have went to each MTs home and tried ipconfig /release, ipconfig /renew and its just either repulling the exact same 24.x.x.x ips or something simular srating with a 24 scheme /sigh

So my questions on this board are.

1: If like comcast mentioned in the very beginning it was a previous internet abuse issue, do companies often block whole IP strings instead of just the IP with the issue? ie every single IP starting with a 24 instead of just the offender like 24.116.134.23? faked number btw happy

2: If the whole IP string was blocked, how the heck do you get certain IPs unblocked?

3: How do you find out who is blocking it? QWEST says they are not blocking anything going to my static IPs, my firewall is setup to not block any ips, when the modem was setup it wasnt set to block any ips. Comcast has no freaking clue and I have had 3 tickets just deleted by them and the latest ticket with comcast tech support has been in the "working on it" process for a MONTH!

Please help, I am at my wits end, and just recently a new hospital I am trying to setup has cable (not comcast) and there ip scheme starts with a 24 and guess what? yup they cannot connect, ping my servers either, ARRRRG!

From what I described above does this sound like a QWEST issue? the tracert's all stop at my reserved gateway, or a Comcast issue? And how does someone like me find out how/who/why is blocking certain ips from reaching my servers?

 

[TheCreator]

I would say it's a Comcast issue, I would get on the phone with them, someone in a higher level and explain the problem to them.

 

[rcolbert]

If you've done tracerts from the home PC's, what router along the way do you stop at? It could be blocking, but it could also be a routing issue. How geographically dispersed are the users and your business?

 

[VioletVenom]

I have done tracert and other forms of Trace routes from each MTs home pc, none of them are on any kind of network, they are all setup the same, 1 computer 1 cable modem, if I use a nicer trace route program like www.visualroute.com it shows it hopping all the way to the reserved gateway of my IPs, if I ping either the ftp site web address or just the ip from each of these people computers it times out.

I am baffled, Comcast is obviouly baffled, they keep deleting my tickets without any kind of resolution, let me tell you they are horrid, first you need to get your name as someone that can make changes on the account before they will even speak to you, then they try all the "Basic" tech stuff. I cannot tell you how many times they told me to unplug the modem wait 10-30 seconds and plug it back in etc. I tell them that the issue isnt the modem and that I cannot ping this ftp site that ANYONE in the whole world can ping as long as their ip doesnt start with a 24, Its like pulling teeth talking to them. I just want these people to be able to connect to me.

I have tried installing vpn clients on them also and without being able to get through they cannot train up either.

 

[rcolbert]

Can you send some verbose config information? Some specific IP addresses and masks? The output of tracerts, etc.?

It sounds like either:

1) IP addresses are being filtered somewhere, although probably not with Comcast because it's their own customer's IP's (not the likely problem)

2) There's a firewall managed service in place somewhere (Qwest?) that shouldn't be (also unlikely)

3) There is a misconfiguration on or close to your end of the network either with the Qwest equipment or your own servers that somehow contains either an invalid subnet mask/ip address combination somewhere that makes your local equipment think the 24.x.x.x network is eiher part of itself or somewhere that it isn't, or an invalid (possibly static) route back to the 24. networks somewhere.

Hard to say really without a bit of poking around here and there at this point. However, it sounds like one of those problems that when you discover it, it will be obvious in hindsight.

 

[Shadowspawn]

My money says its Qwest. You are proving it with your tracert. The trace is making it past Comcast's equipment through the "cloud" to your server's IP, where it stops. You need to call up Qwest while sitting there with the list of IP's on the screen and have them check the last few stops. They have an ACL or something setup to block that specific IP range for some reason.

 

[alrox]

FYI, here is a summary of all Comcast's IP and some peering info.
Same for Qwest

Edit:
Sorry, didn't read the post very well on the first try.

Can you run a network sniffer on your server's end and see if the ping's are actually making it there? You may need to disable the firewall momentarily for the sniffer(tcpdump/etherreal/etc) to see it.

If the ping is hitting your firewall and it is sending an echo reply, but it is not making it back to the other machine, then there may be a routing mixup somewhere or an access-list blocking it.

Edit #2:
You can use the Qwest looking glass to see if qwest is having trouble reaching a comcast IP to rule out the possibility of a routing problem. I don't think Comcast has a looking glass website.

 

[Orinthical]

The problem may lie somewhere in the middle as the 24.X.X.X address block used to be used as the primary distribution block for Comcast when it went under the name of @Home. Consequently back then alot of servers popped up on the 24 subnet for CS and others which may be the "prior abuse" your comcast rep spoke of.

Sadly it's their network and about the only thing you can do has already been suggested -- try speaking to someone higher up the chain and see if you can explain the issue further.

If you are using common ports, try moving the ports around and see if your three people can hit the ftp server.

 

[VioletVenom]

Thanks for the replies all, please keep them coming.

 

[Gunter]

The sad part is, I have the same problem, I used to use browser to access my home machine, e.g \\<ip address here> but Adelphia seemed to have blocked the packets, and for a good reason.

Unfortunately, the technical support of almost all companies are only concerned if you can actually CONNECT to "the internet," not a personal/work fileserver, etc. It seems they always say it is "beyond our scope of support."



When you do ipconfig /release and /renew, usually the DHCP server will just give you the same IP address, unless something else is affecting it, like network traffic.. etc. which would then put you on another DHCP server. (Correct me if im wrong)