Hack the Route Start free Open app Reference
Fixes for common networking problems
Something is broken. Each page gives the likely answer first, then the commands to diagnose and fix it, with the output they printed on real Linux machines, and the lab where you can break it and fix it yourself.
- Large downloads hang but small requests work Usually a path MTU black hole: a link on the path carries smaller packets, and a firewall drops the ICMP message that would tell the sender to shrink them.
- Connection refused vs connection timed out Refused: a machine answered with a reset, so nothing listens there or a firewall rejects it. Timed out: nothing answered, so packets are dropped or lost.
- Service works on localhost but not from another machine The service listens on 127.0.0.1 only, so connections to the machine's real address are refused. Make it listen on 0.0.0.0 or on that address.
- Can reach the local network but not other subnets The machine has no default route, or the wrong prefix on its address, so packets for other networks never go to the router. Check ip route and the prefix.
- Could not resolve host, but the IP address works The machine has no working DNS server: /etc/resolv.conf is empty or names a server that does not answer. Put a reachable resolver in it.
- IP address and routes are gone after a reboot Settings made with ip addr and ip route live only in the running kernel. Write them to the system's network configuration so they are applied at boot.
- Docker container can't reach the internet The container's packets leave with its private 172.17 address, so replies cannot come back. The host needs a MASQUERADE rule for the container network.
- Can't reach a Docker container's port from another machine Nothing forwards the host's port to the container: publishing a port is a DNAT rule on the host. Check it exists and points at the right container.
- Outgoing connections time out behind a DROP firewall The firewall lets requests out but drops the replies, because no rule accepts packets of connections it already allowed. Add the ESTABLISHED,RELATED rule.
- SSL error: unable to get local issuer certificate The client cannot link the server's certificate to a root it trusts: the server did not send its intermediate, or the client's trust store lacks the root.
- Certificate not yet valid or expired on one machine When one machine sees a good certificate as not yet valid or expired, its clock is wrong. Fix the time with NTP, not the certificate.
- Port forwarding stopped working The router forwards the port to the server's old address, or the forward rule is gone. Check the DNAT rule and the server's address; give it a fixed one.
- Ping says Destination Host Unreachable on the local network Your own machine sent ARP requests for that address and nobody answered: the host is off, has another address, or has ARP switched off.