I bought a VPS and built a shadowsocks server on it. It runs well for like 2 months and suddenly failed to work, i.e. I cannot use it overcome the GFW. So I check the server, reinstall everything, check the firewall, but still couldn't solve the problem. Please help me out this puzzle!
First, I can ssh to the server. I'm using a mac and the server OS is CentOS7.
I tried to ping the server from mac, it connects.
PING vultr (108.61.215.163): 56 data bytes
64 bytes from 108.61.215.163: icmp_seq=0 ttl=50 time=485.473 ms
64 bytes from 108.61.215.163: icmp_seq=1 ttl=50 time=407.054 ms
64 bytes from 108.61.215.163: icmp_seq=2 ttl=50 time=429.089 ms
64 bytes from 108.61.215.163: icmp_seq=3 ttl=50 time=552.046 ms
^C
--- vultr ping statistics ---
5 packets transmitted, 4 packets received, 20.0% packet loss
round-trip min/avg/max/stddev = 407.054/468.416/552.046/56.118 ms
Then I telnet it with the specific port that I define in the shadowsocks, but it failed to connect.
# telnet 108.61.216.163 8754
Trying 108.61.215.163...
telnet: connect to address 108.61.215.163: Operation timed out
telnet: Unable to connect to remote host
So from the server I check netstat:
# netstat -anltp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 3253/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 3498/master
tcp 0 0 108.61.215.163:8754 0.0.0.0:* LISTEN 3652/python
tcp 0 0 108.61.215.163:22 218.92.1.158:45819 SYN_RECV -
tcp 0 21 108.61.215.163:22 150.162.11.207:43510 ESTABLISHED 3847/sshd: [accepte
tcp 0 0 108.61.215.163:22 58.49.194.24:55529 ESTABLISHED 3793/sshd: root@pts
tcp 0 1281 108.61.215.163:22 218.92.1.158:19746 FIN_WAIT1 -
tcp 0 1280 108.61.215.163:22 36.156.24.99:50400 ESTABLISHED 3843/sshd: [accepte
tcp 0 0 108.61.215.163:8754 58.49.194.24:56578 SYN_RECV -
tcp6 0 0 :::22 :::* LISTEN 3253/sshd
tcp6 0 0 ::1:25 :::* LISTEN 3498/master
The port is 8754 and the PID3652 is my shadowsocks service.
I also checked my firewall settings, and the port 8754 is open,
# firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: eth0
sources:
services: dhcpv6-client ssh http https
ports: 8754/tcp
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" port port="8754" protocol="tcp" accept
I also checked the iptables and here is what's returned:
# iptables -xvn -L
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
349 31354 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
63 2928 INPUT_direct all -- * * 0.0.0.0/0 0.0.0.0/0
63 2928 INPUT_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0
63 2928 INPUT_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0
1 44 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
47 1972 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 FORWARD_direct all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 FORWARD_IN_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 FORWARD_IN_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 FORWARD_OUT_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 FORWARD_OUT_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT 408 packets, 71561 bytes)
pkts bytes target prot opt in out source destination
410 71641 OUTPUT_direct all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD_IN_ZONES (1 references)
pkts bytes target prot opt in out source destination
0 0 FWDI_public all -- eth0 * 0.0.0.0/0 0.0.0.0/0 [goto]
0 0 FWDI_public all -- + * 0.0.0.0/0 0.0.0.0/0 [goto]
Chain FORWARD_IN_ZONES_SOURCE (1 references)
pkts bytes target prot opt in out source destination
Chain FORWARD_OUT_ZONES (1 references)
pkts bytes target prot opt in out source destination
0 0 FWDO_public all -- * eth0 0.0.0.0/0 0.0.0.0/0 [goto]
0 0 FWDO_public all -- * + 0.0.0.0/0 0.0.0.0/0 [goto]
Chain FORWARD_OUT_ZONES_SOURCE (1 references)
pkts bytes target prot opt in out source destination
Chain FORWARD_direct (1 references)
pkts bytes target prot opt in out source destination
Chain FWDI_public (2 references)
pkts bytes target prot opt in out source destination
0 0 FWDI_public_log all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 FWDI_public_deny all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 FWDI_public_allow all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
Chain FWDI_public_allow (1 references)
pkts bytes target prot opt in out source destination
Chain FWDI_public_deny (1 references)
pkts bytes target prot opt in out source destination
Chain FWDI_public_log (1 references)
pkts bytes target prot opt in out source destination
Chain FWDO_public (2 references)
pkts bytes target prot opt in out source destination
0 0 FWDO_public_log all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 FWDO_public_deny all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 FWDO_public_allow all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FWDO_public_allow (1 references)
pkts bytes target prot opt in out source destination
Chain FWDO_public_deny (1 references)
pkts bytes target prot opt in out source destination
Chain FWDO_public_log (1 references)
pkts bytes target prot opt in out source destination
Chain INPUT_ZONES (1 references)
pkts bytes target prot opt in out source destination
61 2800 IN_public all -- eth0 * 0.0.0.0/0 0.0.0.0/0 [goto]
2 128 IN_public all -- + * 0.0.0.0/0 0.0.0.0/0 [goto]
Chain INPUT_ZONES_SOURCE (1 references)
pkts bytes target prot opt in out source destination
Chain INPUT_direct (1 references)
pkts bytes target prot opt in out source destination
Chain IN_public (2 references)
pkts bytes target prot opt in out source destination
63 2928 IN_public_log all -- * * 0.0.0.0/0 0.0.0.0/0
63 2928 IN_public_deny all -- * * 0.0.0.0/0 0.0.0.0/0
63 2928 IN_public_allow all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
Chain IN_public_allow (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8754 ctstate NEW
15 912 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 ctstate NEW
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 ctstate NEW
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8754 ctstate NEW
Chain IN_public_deny (1 references)
pkts bytes target prot opt in out source destination
Chain IN_public_log (1 references)
pkts bytes target prot opt in out source destination
Chain OUTPUT_direct (1 references)
pkts bytes target prot opt in out source destination
I don't know what to check or what to do now... Please advise... Thank you very much!
