John Caradimas
Level 1 (19 points)
Servers Enterprise

Q: Server 5.1 services only on local network

Hey guys,

 

Just yesterday, I finished upgrading my server to El Capitan and server 5.1. It was not an easy process since I had to manually migrate things, thanks to Migration Assistant not working. But yesterday evening all was well, services were running fine. This morning, for some crazy reason, all services are available on the local network only (Mail, Contacts, Calendar, File Sharing and FTP). I've checked that each user is allowed to use the services mentioned, from all networks, but still, when I activate one of these services, it says they are available only on my local network. The server has a correct DNS entry (it resolves fine using the host command, both ways), and reachability reports that the server is accessible from the internet but no services are available. The same thing happens, if instead of importing my previously used Open Directory image, I create a new one. I still can't get the services to be available on the internet, plus my disk where my network user directories are installed, can't be selected. Crazy things!

 

Any help would be greatly appreciated.

Posted on Apr 8, 2016 11:07 AM

Close
John Caradimas

Q: Server 5.1 services only on local network

  • All replies
  • Helpful answers

  • by John Caradimas,

    John Caradimas John Caradimas Apr 15, 2016 4:07 AM in response to John Caradimas
    Level 1 (19 points)
    Servers Enterprise
    Apr 15, 2016 4:07 AM in response to John Caradimas

    I just discovered something quite frustrating.

     

    First of all a description of my network, so you can understand what’s going on.

     

    My network consists of a VDSL modem in bridge mode. Following that, there is a Sonicwall router/firewall. All my computers are connected to that firewall, that includes my Apple server. The server has a real IP address, which is verified by all DNS tests (forward and reverse DNS show the proper responses). On the firewall, ports for Contacts, Calendar, email services etc are already open, and they are working fine, when I boot the server in Mavericks using the old (pre-5.1) Server.app. Of course, all other services, from the Wide Area Network to my local area network are blocked on the firewall.

     

    If I boot the server using El Capitan and Server.app 5.1, Reachability shows that the server is accessible using its real FQDN name, but with no available services.

     

    Today, I decided to do a test. I eliminated the firewall rule which was blocking “all other services” to my Apple server, so that anything and anyone could connect to it. Guess what? Reachability immediately showed 6 services running and identified them correctly. Not only that, but all defined services in Server.app, changed from being available on my local network only, to being available on the internet on my server's FQDN!!!

     

    I then switched reachability testing off in Server.app, and all services were immediately changed to being available only on my local network.

     

    This means that unless reachability testing is enabled and it is allowed to cross the firewall, no matter if all the proper ports for the declared services are open in the firewall, Server.app is not allowing access to the defined services, from the internet.

     

    That is NOT GOOD! Why should Server.app be affected by reachability testing? Why should services be stopped from working on the internet, when all relevant ports are open? Why should I have Apple constantly testing my network?

  • by Leopardus,

    Leopardus Leopardus Apr 15, 2016 5:56 AM in response to John Caradimas
    Level 4 (1,087 points)
    Desktops
    Apr 15, 2016 5:56 AM in response to John Caradimas

    John,

     

    Have you tested this? Or are you merely relying on the green dots and feedback from server? How do you know that DNS resolves correctly? From the server app? No, you will check with the Command line or use something like http://dnscheck.ripe.net/ to verify!

     

    The same goes for other services that you want, whether it is on the local subnet or to the wider internet et.al. Verify, using Safari with your domain name/IP address and the port number/service on your iPad from an external connection, if indeed all the services have all of a sudden been halted. It certainly is not the case with me and others. Admittedly our setup differs substantially, although we also use firewalls.

     

    Kindly just check first.

     

    Leo

  • by John Caradimas,

    John Caradimas John Caradimas Apr 15, 2016 6:39 AM in response to Leopardus
    Level 1 (19 points)
    Servers Enterprise
    Apr 15, 2016 6:39 AM in response to Leopardus

    Well, this is becoming an exercise in futility.

     

    Trying to upgrade my Mavericks server disk to El Capitan gets interrupted. I sent the log to Apple server group, but they obviously haven't examined it. So I work on my own, after I migrated the server manually to a new El Capitan disk.

     

    And yes, I did some tests. It's not just the dots, the dots appear even when the services are shown to be available only on the local network. But I did verify that when Reachability is disabled all services are changed to available to "local network" only. If I enable it, they become available to the FQDN. That, of course, provided that my firewall is wide open from 17.0.0.0/8 network. If I block it, again reachability shows no services and all services defined are changed to Internal network only.

     

    The way I found out that something is wrong with El Capitan server, is when my telephone stopped seeing my contacts from the server, when I was out of the house. It showed them fine when I was on the house wifi netwok.

  • by axel marc,

    axel marc axel marc Aug 30, 2016 6:08 AM in response to John Caradimas
    Level 1 (12 points)
    Servers Enterprise
    Aug 30, 2016 6:08 AM in response to John Caradimas

    Hello,

     

    I got a "similar" problem. During the development phae the server had a 'real' ip address. now that we installed in another datacentre we have an ipaddress behind a NAT router and a firewall set-up by the centre. The right ports are open.

    Of 6 Services reachable (6) it went  down to 1. [ssh] .  The only changes we made before moving to the other datacentre was the IP address, subnet mask, router and DNS server. Access is quite normal over VNC and the webserver works well, but FTP is way too slow and AFP is a hog.

     

    ?