corporate firewall blocks apt-get, but only where installed, not LiveCD?

[danielk]

user@UBUNTU1:~$ sudo apt-get update
0% [Waiting for headers]

That's about as far as I get, unless I let it sit for 20 minutes, then maybe I will get up to 50% on the first repository. I searched all over the forum, and didn't have any luck finding any similar issues.

About 2 weeks ago, I had a working kubuntu install as part of a pilot program the company is looking at, and apparently the networking guys installed a new firewall without notifying anyone. I think it's a Cisco PIX based, but I'm not certain. Anyway, now updates no longer work from any of the installed stations. Networking says it isn't their problem, they didn't break it. Funky part is when you boot from a live-CD, update appears to work OK. Run it from an install on the HDD, nothing. Sometimes it appears to update, very, very, slowly. Previously it was all headers for all repositories in under 1 minute. Their recommended solution was to tell us to set up a server and host our own repository internally, and update from that. Honestly, that is not an acceptable solution.

I am for most purposes fairly green, and am learning as much as I can, but I can't find a way to fix this. As far as I was able to tell, update traffic goes out via port 80, so we shouldn't have to open any additional ports on the firewall to make this work, should we? Normal web traffic works OK, as this was posted from one of the affected machines. Our Ubuntu desktop is similarly affected as well.

I'm really stuck, and open to suggestions. We were in the process of setting up test stations for users, to get their opinion on what they liked when this happened. The project is effectively hung, and so far neither my cursing at the computer or repeated attempts to make it work have had any effect. If anyone can help out with what we need to do to make this work, whether it is something that can be pointed out to the networking guys, or something specific in the install, I would be most appreciative.

[eriefisher]

Re: corporate firewall blocks apt-get, but only where installed, not LiveCD?

Have you tried to ping one of the repo servers? I'm not sure if it would help but it might tell you if you are actually reaching them. Their firewall might be blocking certain types of traffic like ftp or something.

[danielk]

Re: corporate firewall blocks apt-get, but only where installed, not LiveCD?

ping works fine. Also,I can open up the URL in a browser and have no difficulties browsing through and downloading files. One of our networking guys swapped out http for ftp in the request and tells me that worked fine as well. not sure what he did, as it makes no sense, but whatever. It seems that you can get to the files without a problem through anything BUT apt or related programs like adept. Networking guys are stumped, said the transfer stops dead at 20mb, which also makes no sense as I don't see headers being that large. They opened a ticket with Cisco, but I'm not sure how that will go.

[penguin.ch]

Re: corporate firewall blocks apt-get, but only where installed, not LiveCD?

I'm really stuck, and open to suggestions.

Merely a gut feeling ... but if were you, I'd thoroughly "compare & contrast" the network settings (as saved in /etc/network/interfaces, /etc/resolv.conf, etc. pp. ) of live / default versus installed system ...

[Cyrus Jones]

Re: corporate firewall blocks apt-get, but only where installed, not LiveCD?

I'm hinting that it maybe something to do with IPv6 enabled on installation. Possibly?

Your problem may be the result of IPv6 interfering with IPv4 (which you are most likely using).

You can tweak by disabling IPv6 if you don't use it.

IPv6 is short for "Internet Protocol Version 6". IPv6 is the "next generation" protocol designed by the IETF to replace the current version Internet Protocol, IP Version 4 ("IPv4").

Most of today's internet uses IPv4, which is now nearly twenty years old. IPv4 has been remarkably resilient in spite of its age, but it is beginning to have problems. Most importantly, there is a growing shortage of IPv4 addresses, which are needed by all new machines added to the Internet.

IPv6 fixes a number of problems in IPv4, such as the limited number of available IPv4 addresses. It also adds many improvements to IPv4 in areas such as routing and network autoconfiguration. IPv6 is expected to gradually replace IPv4, with the two coexisting for a number of years during a transition period.

See this documentation on how to disable IPv6:
https://help.ubuntu.com/community/We...ngSlowIPv6IPv4

[Cyrus Jones]

Re: corporate firewall blocks apt-get, but only where installed, not LiveCD?

Out of curiosity, what repo [mirror] are you using? See the file /etc/apt/sources.list. Could you paste the text in that file into your post?

[danielk]

Re: corporate firewall blocks apt-get, but only where installed, not LiveCD?

Out of curiosity, what repo [mirror] are you using?

Everything is default install, we had literally just gotten the unit installed the day prior and then all this hit the fan. I don't believe that we even had a chance to run updates yet. From what I recall, we had cleared out the sources.list and repopulated it with the defaults from within adept (I think). This was after we couldn't update, so I know that didn't break it, but it didn't help the problem we were having. I will try and get that when I'm in the office tomorrow.

I'm hinting that it maybe something to do with IPv6 enabled on installation. Possibly?

This is entirely possible. I'm not certain that the networking guys knew that anything on the network used IPv6. I'm not familiar with troubleshooting 4 vs 6, is it possible for some things to work but not others? Web browsing, FTP, etc. all seem to work fine.

[danielk]

Re: corporate firewall blocks apt-get, but only where installed, not LiveCD?

Out of curiosity, what repo [mirror] are you using? See the file /etc/apt/sources.list. Could you paste the text in that file into your post?

Every time we try and update they all appear to fail, so the installer comments them out. We uncomment them and retry, but with no success. As follows:

deb [url]http://91.189.88.31/ubuntu/[/url] dapper main restricted

# Line commented out by installer because it failed to verify:
# deb [url]http://us.archive.ubuntu.com/ubuntu/[/url] dapper main restricted 
# Line commented out by installer because it failed to verify:
# deb-src [url]http://us.archive.ubuntu.com/ubuntu/[/url] dapper main restricted 

## Major bug fix updates produced after the final release of the
## distribution.
# Line commented out by installer because it failed to verify:
# deb [url]http://us.archive.ubuntu.com/ubuntu/[/url] dapper-updates main restricted 
# Line commented out by installer because it failed to verify:
# deb-src [url]http://us.archive.ubuntu.com/ubuntu/[/url] dapper-updates main restricted 

## Uncomment the following two lines to add software from the 'universe'
## repository.
## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team, and may not be under a free licence. Please satisfy yourself as to
## your rights to use the software. Also, please note that software in
## universe WILL NOT receive any review or updates from the Ubuntu security
## team.
# deb [url]http://us.archive.ubuntu.com/ubuntu/[/url] dapper universe 
# deb-src [url]http://us.archive.ubuntu.com/ubuntu/[/url] dapper universe 

## Uncomment the following two lines to add software from the 'backports'
## repository.
## N.B. software from this repository may not have been tested as
## extensively as that contained in the main release, although it includes
## newer versions of some applications which may provide useful features.
## Also, please note that software in backports WILL NOT receive any review
## or updates from the Ubuntu security team.
# deb [url]http://us.archive.ubuntu.com/ubuntu/[/url] dapper-backports main restricted universe multiverse 
# deb-src [url]http://us.archive.ubuntu.com/ubuntu/[/url] dapper-backports main restricted universe multiverse 

# Line commented out by installer because it failed to verify:
# deb [url]http://security.ubuntu.com/ubuntu[/url] dapper-security main 
# Line commented out by installer because it failed to verify:
# deb-src [url]http://security.ubuntu.com/ubuntu[/url] dapper-security main 
# deb [url]http://security.ubuntu.com/ubuntu[/url] dapper-security universe 
# deb-src [url]http://security.ubuntu.com/ubuntu[/url] dapper-security universe

[penguin.ch]

Re: corporate firewall blocks apt-get, but only where installed, not LiveCD?

Did you try to replace the relevant domain names (e.g. us.archive.ubuntu.com) by their IP addresses (e.g. 91.189.89.6):

deb [url]http://[b]us.archive.ubuntu.com[/b][/url][b][/b]/ubuntu/ dapper main restricted
--
USER@FREYJA # ping us.archive.ubuntu.com
PING us.archive.ubuntu.com (91.189.88.31)
--
deb [url]http://[b]91.189.88.31[/b][/url][b][/b]/ubuntu/ dapper main restricted

It with this bricolage "apt-get updates" were possible, I'd suggest to take a (very) close look at your local DNS settings (stored in /etc/resolv.conf et al.) ... (?)

[danielk]

Re: corporate firewall blocks apt-get, but only where installed, not LiveCD?

Did you try to replace the relevant domain names (e.g. us.archive.ubuntu.com) by their IP addresses (e.g. 91.189.89.6):

yup. see the first line of the sources.list I posted. You used the same IP in the code you posted.
It didn't help so we changed them back to the domain names, just missed that first one.

It with this bricolage "apt-get updates" were possible, I'd suggest to take a (very) close look at your local DNS settings (stored in /etc/resolv.conf et al.) ... (?)

I actually had to look up bricolage, I don't think I've ever seen that word before. I'm still not certain what your asking, though. Per my previous posts, I can get the sites, from within any other application, IE Firefox, Konqueror, FTP client, etc., just not from apt or adept. If it were a DNS issue, it should fail across the board, correct?

I will check the settings, but all the machines previously worked (ubuntu stations FWIW), and we were in the process of setting up this kubuntu box. Then they all stopped being able to update. Does anyone know if there is something different about headers and/or update network traffic when compared to normal traffic via port 80? I'm starting to think that the firewall is flagging something as possibly a protocol and/or port issue.

[penguin.ch]

Re: corporate firewall blocks apt-get, but only where installed, not LiveCD?

see the first line of the sources.list I posted

Just wasn't sure how to interpret that ...

I'm still not certain what your asking, though.

Me neither actually, it merely expressed some gut feelings (to no avail, so far ...).

Anyway, final attempt: is it possible to connect the machine in question to a different network - at least to eliminate a couple of suspects (?).

[danielk]

Re: corporate firewall blocks apt-get, but only where installed, not LiveCD?

Anyway, final attempt: is it possible to connect the machine in question to a different network - at least to eliminate a couple of suspects (?).

One of the guys working on this started kubuntu in a vmware session on his personal laptop via live-cd, and was able to update from within the live-cd session okay. He started the install from said session, and after he finished, he tried to update again and it failed. Same issue as we are having on the other systems. He took the machine home, tried to update again and had no problem. The update from his home network worked fine.

[Cyrus Jones]

Re: corporate firewall blocks apt-get, but only where installed, not LiveCD?

See this thread:
http://kubuntuforums.net/forums/index.php?topic=3082374

It may help, as it has an identical sources.list file (the repositories are commented out).

[Cyrus Jones]

Re: corporate firewall blocks apt-get, but only where installed, not LiveCD?

Try uncommenting (by removing the the # from the lines beginning with 'deb' or 'deb-src').

[penguin.ch]

Re: corporate firewall blocks apt-get, but only where installed, not LiveCD?

The update from his home network worked fine.

Why am I not surprised ... mumble, mumble ... back to square one then:

# Kubuntu makes use of DHCP in one form or the other (which, depending on the network, may or may not work ...). At least for the sake of completeness, I'd reset the (virtual) Kubuntu system to static IP and DNS, respectively, and kill DHCP (as well as "avahi") for the time being.

# Just to ensure that the FTP protocol won't get blocked by the firewall(s), I'd fire up an client and try to download some stuff, e.g. from http://www.penguin.ch/repository/.

In the meantime, I'll try to get hold of APT's source code in order to (hopefully) find out more about the way the package manager communicates with the external servers ...

--

Postscript: after several hours of poring over absolutely unspectacular source code, I decided to "change (my) target" and installed the Guarddog firewall application on an system working up to now ...

Of course, with all and every protocol blocked, apt-get got nowhere, so to speak - but in order to get things going again, I had to permit the Network File System (NFS) protocol