Problem - "is functioning normally"

[djcart]

Hi, I’m having an issue with my environment — for two clients their websites sometimes work normally, and other times they display the message:


“is functioning normally”


The setup consists of two servers:

1. one server handles DNS,
2. the second server handles all traffic.
   They are configured in multiserver mode.

I’ve mainly noticed this issue with two clients.


All servers are running CL + DA + LS Enterprise and Imunify360.

 

[DrWizzle]

Check your server's IPv6 is linked to the IPv4 and the AAAA records are set correctly if you're running IPv6 as well on the server. If you don't link the 2 IPs and an incoming request hits the IPv6 listener, if the virtualhost files arent setup properly it will just display "Is functioning normally"

It's almost definitely a DNS issue somewhere in your chain.

 

[Richard G]

1. one server handles DNS,
2. the second server handles all traffic.
   They are configured in multiserver mode.

So they both do DNS, Because multiserver mode is only kindlike a DNS backup, multiserver does not do anything else.
But for sure this is a DNS issue somewhere.

Doublecheck if all DNS records are correctly the same in the bind .db files of these domains on both servers.

And if you're using ipv6, if not linked correctly, link ipv6 to the ipv4 instead of the other way around or are not linked as @DrWizzle says, one can also encounter these issues.

 

[djcart]

I noticed that the issue appears only on accounts using one specific IP address.
After changing these accounts to a different IP, the problem no longer occurs.


I checked all blocking rules and found no blocks related to this problematic IP.
Is it possible that someone else in the datacenter is using this IP address?

 

[DrWizzle]

I very much doubt it, but that's something you would have to take up with the datacentre you host with. Maybe you can request an IP switch if you think that IP could be compromised?

 

[djcart]

It looks like my suspicions were correct. After detaching the IP address from the server and entering it in the browser, it still shows “functioning normally.” It appears that someone has been using that address.

 

[Richard G]

the IP address from the server and entering it in the browser, it still shows “functioning normally.”

Refresh the page or use another browser to be sure it's not browser cache.
If not, then indeed somebody else is using the ip too and you have indeed to contact your data center.

 

[zEitEr]

It looks like my suspicions were correct. After detaching the IP address from the server and entering it in the browser, it still shows “functioning normally.” It appears that someone has been using that address.

If you removed the IP from Directadmin only, it might still exist on the server's network interface. If this is the case, then it's normally that you see the default page from /var/www/html/index.html which is shown to every domain/ip which have no a separate virtual host.

Usually IPs are bind to a MAC address by a datacenter, and hardly can anybody highjack an IP from another host. So your issue is most likely caused by a misconfiguration of the link between IPv4 and IPv6 as already mentioned by the user @DrWizzle .