Aliyun International Agent: ECS Server Public Network IP Ping Interconnection? Common Causes and Troubleshooting Steps
When using Aliyun ECS cloud server, many users will encounter a common problem: the server has been started normally and the public network IP can be seen in Aliyun console, but when the local computer executes Ping command, the request timeout is always displayed.
When some users encounter this situation, they will suspect that the server network is malfunctioning and even think that the public network IP is blocked. In fact, Ping failure does not necessarily mean that the server cannot be used normally, nor does it necessarily mean that there is a problem with Aliyun network.
Alibaba Cloud International Agents
lingducloud will answer for you because the Ping command uses ICMP protocol, while services such as website access and SSH remote connection usually use TCP protocol. The two work differently, so even if the ping fails, the website on the server may function normally.
Then, what is the reason why the Alibaba Cloud ECS public network IP Ping is not working? The following describes several troubleshooting methods based on common situations in actual use to help you quickly find the problem.
1. First, confirm whether the ECS server is running properly.
In case of public network IP Ping failure, the first step is not to modify the network configuration in a hurry, and first confirm whether the server itself is in a normal state.
Log on to the Aliyun official website, go to the ECS cloud server console, find the corresponding instance, and check the following information:
Is the instance running status "Running"?
Has the server been assigned a public IP address?
Whether the current public IP address is correct.
Check whether the instance has any outstanding payments, is suspended, or displays other abnormal status indicators.
If the instance has been stopped or the service is restricted due to account arrears, the instance cannot be accessed normally.
In addition, some users purchase a pay-as-you-go ECS instance. After releasing or recreating resources, the public IP may change. If you still use the previously saved IP address for the ping test, you will also be unable to connect.
After confirming that there is no problem with the instance and public IP, continue to check the network configuration.
2. check whether an Alibaba Cloud security group allows the ICMP protocol
This is one of the most common reasons why the Alibaba Cloud ECS server cannot ping.
Alibaba Cloud International Agents
When creating a server, many users only configure ports 80 and 443 required by the website or 22 ports required by remote connection, but do not notice that Ping uses ICMP protocol.
If the security group does not allow ICMP traffic, the external computer may not receive the ping response even if the server is functioning properly.
Specific operation steps:
Log in to the Alibaba Cloud ECS console.
Find the server instance that needs to be checked.
Go to the instance details page.
Find the associated security group.
Click the security group ID to go to the rule management page.
Select Incoming Rules to check for rules that allow the ICMP protocol.
If not, you can add a rule based on actual needs.
Note when configuring:
Direction: Inbound
Authorization policy
:Allow
Protocol Type: ICMP
Port range: Configure as required by console ICMP rules
Authorization object: It is recommended to enter a trusted source IP address.
It should be noted that ICMP protocol is not TCP or UDP protocol, and Ping access cannot be realized simply by opening ports 22, 80 and 443.
In addition, if you only want to test whether the server is normal, it is recommended to test SSH or website port at the same time, and do not judge the network status of the server based on the Ping result alone.
3. check the internal firewall of Linux system
If the ICMP protocol has been allowed by the Alibaba Cloud security group, but the public IP is still unable to ping, you need to check the firewall inside the server operating system.
Security groups and system firewalls are two separate security layers.
Alibaba Cloud international reseller
The security group allows traffic to enter and does not necessarily mean that the server will accept these requests internally.
For systems that use Firewalld, such as CentOS and Rocky Linux, you can execute:
systemctl status firewalld
View the current running status of the firewall.
If you are using an Ubuntu system, you can do:
ufw status
Check the UFW firewall configuration.
In addition to the regular firewall, you can check the iptables rules:
iptables -L -n -v
If the server is configured with custom firewall rules, you need to focus on whether there are DROP or REJECT rules for the ICMP protocol.
For example, some servers proactively prohibit external ping requests to improve security. In this case, the server will not respond to the Ping command even if it can normally provide the website service.
It is not recommended to turn off all firewall rules directly for testing purposes. The correct approach is to confirm the specific interception strategy, and then adjust according to the actual security needs.
4. check if the server has ICMP response enabled
In addition to the firewall, the Linux system itself can control whether to respond to ICMP Echo requests.
You can execute the following command:
cat /proc/sys/net/ipv4/icmp_echo_ignore_all
If returning:
1
Explain that the system is configured to ignore all IPv4 ICMP Echo requests.
If returning:
0
The system does not use this parameter to globally ignore the ping request.
If you do need to allow a ping response, you can do this temporarily:
sysctl -w net.ipv4.icmp_echo_ignore_all=0
If you want it to take effect after the restart, you can modify the system configuration:
echo "net.ipv4.icmp_echo_ignore_all=0" >> /etc/sysctl.conf
sysct
l -p
However, it is recommended to confirm whether other security policies require that ICMP responses be prohibited before making changes. For production environment servers, do not arbitrarily modify system security configurations simply to make the Ping command appear functional.
5. Use telnet or nc to test the server port.
If the security group and the system firewall do not find any problems, you can further test the TCP port of the server.
This is a practical way to determine whether the server network is truly abnormal.
For example, on the local computer:
Telnet Public IP 22
If the server has SSH service enabled and port 22 allows access from the current source IP, a connection can usually be established.
You can also use the nc command:
nc -vz public_IP 22
If you need to test the site, you can change the port to 80 or 443:
nc -vz public_IP 80
nc -vz public_IP 443
Based on the test results, we can roughly determine the source of the problem:
Ping is not available, but port 22 can be connected: ICMP may be restricted and SSH network connection is normal.
Ping is not working, but port 80 can be connected: this indicates that the website service may be normal, and it is not necessary to determine the server failure because of Ping timeout.
Ping is not available, and all TCP ports cannot be connected. You need to continue to check the security group, system firewall, service listener, and public network.
Note that the failure of the TCP port test does not necessarily mean that the public network link fails. It may also mean that the service is not started, the port is not monitored, or the access source is restricted.
6. Check whether the public IP address has triggered Alibaba Cloud's black hole protection.
If the server has been able to Ping normally before, and suddenly the public network IP cannot be accessed, and the website, SSH and other services cannot be connected at the same time, you need to consider whether the black hole protection of Aliyun is triggered.
In order to protect the cloud server and network infrastructure, Alibaba Cloud may implement black hole processing on the affected public network IP when detecting large abnormal traffic or DDoS attacks.
Simply put, it is to temporarily restrict the external traffic of the relevant public network IP to avoid further attacks affecting the network.
In this case, you can check as follows:
Log in to the Alibaba Cloud console.
View the Security Center or DDoS Protection page.
Check whether the public IP address has a black hole status or related security events.
Check whether the security alert notification sent by Alibaba Cloud has been received.
Wait for processing or submit a work order consultation according to the console prompts.
If it is confirmed that the network exception is caused by black hole protection, simply modifying the security group or restarting the server cannot solve the problem.
It is recommended to check first.
Alibaba Cloud international reseller
Official security tips, confirm the specific status and lifting conditions, do not frequently replace IP to try to avoid security protection.
7. Use traceroute to troubleshoot network links.
If there is no obvious problem with the server configuration, but accessing the public network IP from the local network is still abnormal,
You can use a route tracing tool for further analysis.
Windows the computer can open CMD, perform:
tracert public IP address
On Linux or macOS, you can run:
traceroute public IP address
If the system does not have traceroute installed, you can use the corresponding package management tool to install it according to the release version.
This command can display the network node through which the data packet passes and help determine which link of the connection is abnormal.
For example:
If the local network exit is abnormal, it may be related to the current broadband or carrier network.
If an intermediate node does not respond, it does not necessarily mean that the link is down, because some routing devices will limit ICMP probing.
If the detection still cannot be completed after reaching the vicinity of the target network, the determination needs to be continued in combination with the network configuration on the server side.
It is recommended to change a network environment for testing at the same time, such as using mobile phone hotspots, or testing the target public network IP through cloud servers in other regions.
If the test results vary significantly in different regions, you can further submit a work order to Alibaba Cloud to provide the test time, source IP address, target IP address, and traceroute results to facilitate technicians to locate the problem.
8. the public IP Ping of Aliyun ECS is not working, how should I quickly judge?
If you don't want to check item by item, please refer to the following table:
Phenomenon
Priority Inspection Direction
Ping is not working, but the website is normal.
ICMP security group rules, system firewall
Ping fails, but SSH is working fine.
ICMP Response Policy
Ping fails, and SSH also fails.
Security groups, system firewalls, SSH service
After restarting, the Ping suddenly failed.
Public IP address changes, network configuration
Sudden interruption of all external access
Black hole protection, public network status
Only a certain region is inaccessible.
Operator networks, routing links
We recommend that you perform the troubleshooting in the order of instance status, security group, system firewall, ICMP configuration, TCP port, black hole status, and network link.
This can avoid modifying the complex network configuration at the beginning and reduce unnecessary operations.
9. purchasing Alibaba Cloud servers, network configuration is equally important
For users who are ready to build websites, deploy applications, or conduct cross-border business, choosing a suitable cloud server is very important.
Alibaba Cloud ECS provides a variety of instance specifications and regions. Different configurations are suitable for different business scenarios.
For example, personal blogs and ordinary display websites can choose the appropriate CPU, memory and public network bandwidth according to the traffic volume. For enterprise business and websites with large traffic volume, server performance, network quality, data security and later expansion capability need to be further considered.
If your business is mainly for overseas users, you also need to focus on the quality of the network connection between the server region and the target user, not just the server price.
Zero degree cloud (
www.lingducloud.com) provide Aliyun account
ECS cloud server and related cloud product selection services to help users choose the right cloud computing resources according to actual business needs.
If you are looking for Alibaba Cloud servers or need to know the differences between different regions, configurations, and products, you can visit the Zero Cloud website to view relevant product information.
Before buying, it is recommended to clarify the purpose, budget and network requirements, and choose the configuration suitable for your business, which is more practical than blindly pursuing low prices.
Summary
The public IP Ping of the Alibaba Cloud ECS server does not necessarily mean that the server has failed.
The most common reasons include that the security group does not allow ICMP protocol, system firewall interception, Linux system prohibits ICMP response, and public network IP triggers black hole protection.
When you have a problem, don't just stare at the results of the Ping command. Comprehensive judgment can be made by combining TCP port test, system log and route trace.
As long as you follow the correct order of step-by-step investigation, most common problems can find a clear cause. If you confirm that the server configuration is normal, but the public network still cannot be connected, it is recommended to seek technical support through Aliyun ticket in time.
