Unable to browse or receive POP3 email from web site.

Do the below to trouble shoot this problem

 As you are unable to even resolve the domain to an IP Address.
then open the location C:\WINDOWS\system32\drivers\etc and open the hosts file in notepad
and add an entry below
127.0.0.1                localhost
yourserverip           yourdomainname

after doing save the changes  and check that if you are able PING and able to recieve and browse the website on the server

I you suceed then check the DNS entry in the DNS server from the Name server Provider.

Honez: attempts to access by name or IP are unsuccessful.  A "ping" by name will return the IP address, but the response times out just as a "ping" by IP address will time out.

vikshi:  the results of your suggestion after the change was made in the HOSTS file are no different; unable to browse or ping the site.

I believe we are getting name resolution based on the results of "ping" by name returning the correct IP address. Since I discovered unauthorized software that appears to be installed about the same time as the POP3 email problem was observed, I am suspicious of the relationship.  The software has been uninstalled and all files deleted, but the problem remains.

Thanks for your comments; looking foward to additional suggestions.

Winrar wouldnt contribute to the symptoms.  Not sure about the other 2.  If you try a pathping or tracert to the ip, how far does it get?  Can you ping the site from the fw?

HONEZ:
I have a Linksys BEFRS41, which does not have a diagnostic capability.

I have something interesting. It turns out that my office and the client's office utilize the same ISP, so I did a TRACETR from both locations with the following results:
From CLIENT LOCATION,
Tracing route to clientname.com [72.37.245.A] over a maximum of 30 hops:
  1     1 ms     1 ms    <1 ms  10.0.0.1
  2     6 ms     5 ms     5 ms  63-252-119-101.mcleodusa.net [63.252.119.101]
  3    19 ms    19 ms    19 ms  chcgilwuh53jc03-so2-2-0-0.mcleodusa.net [64.198.100.66]
  4    32 ms    20 ms    33 ms  xe1-1.cr01.ord01.mzima.net [206.223.119.62]
  5    31 ms    32 ms    35 ms  te0-0.cr01.dfw01.us.mzima.net [69.174.120.14]
  6    79 ms    71 ms    71 ms  te1-1.cr01.phx01.us.mzima.net [69.174.120.37]
  7    73 ms    71 ms    71 ms  te1-1.cr01.lax02.us.mzima.net [69.174.120.33]
  8    68 ms    70 ms    68 ms  ge0-webnx.cust.lax04.mzima.net [72.37.172.158]
  9     *        *        *     Request timed out.
 .
 30     *        *        *     Request timed out.
Trace complete.

Now from my office, utilizing the same ISP:

Tracing route to clientname.com [72.37.245.A] over a maximum of 30 hops:
  1    <1 ms    <1 ms    <1 ms  192.168.115.254
  2    14 ms    14 ms    14 ms  63-252-122-65.ip.mcleodusa.net [63.252.122.65]
  3    18 ms    14 ms    14 ms  63-252-123-81.mcleodusa.net [63.252.123.81]
  4    32 ms    32 ms    29 ms  chcgilwuh53jc03-so2-2-0-0.mcleodusa.net [64.198.100.66]
  5    28 ms    30 ms    33 ms  xe1-1.cr01.ord01.mzima.net [206.223.119.62]
  6    34 ms    44 ms    48 ms  te0-0.cr01.dfw01.us.mzima.net [69.174.120.14]
  7    80 ms    88 ms    89 ms  te1-1.cr01.phx01.us.mzima.net [69.174.120.37]
  8    81 ms    85 ms    93 ms  te1-1.cr01.lax02.us.mzima.net [69.174.120.33]
  9    75 ms    81 ms    81 ms  ge0-webnx.cust.lax04.mzima.net [72.37.172.158]
 10    85 ms    69 ms    74 ms  server9.verygoodserver.com [72.37.245.A]
Trace complete.

Is this of interest?
  - the first entry from my office is my firewall's internal address
  - the first entry from my client's office is 10.0.0.1; their router's internal address is 192.168.1.1

  - once you get past the closest nodes, 6 of the nodes are common. From the client's site, however, we receive a timeout at the last common node (72.37.172.158).  

Is this due to the starting address of 10.0.0.1?  I performed a FIND in REGEDIT for 10.0.0.1; nothing. The only entry in HOSTS is 127.0.0.1.  

Is this useful info?

Thanks,



 

SO the problem is at the clients office, your office is ok?  If the config on the FW is simple, delete it and rewrite it.  The 10.0.0.1 is coming from somewhere.

Also you need to dump the befsr41. That was their first attempt at router, and really isnt considered a FW.  AT last check it didnt even do Stateful packet inspection. Look at the netgear fvs318 or the cisco asa5505.  Not saying the FW is the problem, its just been outgrown.

was the trace from the fw or from a host?

HONEZ: all tracing is from a host since the router does not have the ability to run diagnostics.

Server: 192.168.1.10
Default Gateway (Router): 192.168.1.1

So where is 10.0.0.1 coming from ?  Is this a concern? What tool can be used to identify the source of this address?

Should the first address in the TRACERT be 192.168.1.1?  From my novice position, I assume it is a problem since it seems to be a fundamental difference in a network that can browse to the site and one that can't. I'm open to additional suggestions.

Thanks......

 

Yes, the first hop should be your gateway.  do an ipconfig/all on the server and see if the 10. address shows up anywhere.  Mainly to see if the server is acting as a router for some reason.  Also scrutinize the FW for the same address.  Its been along time since ive seen an sr41 so I cant remember what services it offered.  If that routers config isnt too complex, then I would consider using the reset button, then reconfigure it.  If you have rebooted it yet, than try that now.

IPCONFIG /ALL from the server:
Windows IP Configuration

   Host Name . . . . . . . . . . . . : SERVER-1
   Primary Dns Suffix  . . . . . . . : CLIENT.local
   Node Type . . . . . . . . . . . . : Unknown
   IP Routing Enabled. . . . . . . . : Yes
   WINS Proxy Enabled. . . . . . . . : Yes
   DNS Suffix Search List. . . . . . : CLIENT.local

Ethernet adapter Server Local Area Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
   Physical Address. . . . . . . . . : uu-vv-ww-xx-yy-zz
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 192.168.1.10
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.1.1
   DNS Servers . . . . . . . . . . . : 192.168.1.10
   Primary WINS Server . . . . . . . : 192.168.1.10

Nothing unusual here.

In the router, the following ports are allowed in PORT RANGE FORWARDING:
3389, 1723, 25, 443, 444, 4125 80 all forward to 192.168.1.10

There is no PORT FORWARDING, UPnP FORWARDING is disabled, DMZ is disabled, NAT is enabled, DYNAMIC ROUTING is disabled.  

I am suspicious that my server may be hijacked.....

Is this server being used as a router?  check out the Ip Routing enabled and the wins Proxy enabled.

Im more concerned with the routing. based on your symptoms.

Server should NOT be used as a router as it has only 1 NIC.

.....but now you lost me!....Where do I check out the IP Routing Enabled and WINS Proxy Enabled?

OK....Let's see if I'm close.

IP ROUTING ENABLED:
    Advanced Management>Computer Management>Routing and Remote Access>Properties
         Enable this computer as a                 ROUTER.........is NOT checked
                                                                   REMORE ACCESS SERVER.......IS checked.

WINS PROXY ENABLED:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ Netbt\Parameters\EnableProxy has value of 2 (NOT Enabled?)

Final solution: It turns out that there was a failed attempt to logon to the website 5 times within 5 minutes. The hosting company treated this as an attack and disabled further communications from the client's office.....seems that no one was ever notified of this event.  This also cut off attempts to retrieve mail from the web site.  Hosting company as re-eenabled access from the client's office.