curl timeout troubleshooting

Question

I tried to curl popular websites e.g. curl google.com or curl google.com:80 and there is always a timeout error.

Some troubleshooting steps performed:

1. Able to curl localhost with response
2. Able to ping google.com with response
3. Tried change DNS to google DNS but to no avail
4. Tried wget and it does not work for external sites either

Questions:

1. May I know what is the default port that curl is using?
2. Is this related to Firewall blocking? As far as I know port 80 is open for the server I am using.
3. What else can I do to further troubleshoot?

Solution

If this is a hosted webserver I would suspect that it's been configured in a classic webserver fashion. Meaning that it allows incoming connections on port 80 but for security they may have disallowed outgoing connections on port 80. I would guess this is the issue. curl and wget generally work out of the box with no issues. curl chooses a port based on the URI given (http will be 80, https 443, ftp 21, and so on); when no protocol is given as you are using it will use 80. To troubleshoot this just disable your firewall for a second (or edit the settings if you are worried about it being down for a few seconds).

Update:

May I know is there a easy way to confirm that port 80 (outgoing) is block?

I'd say that you've done this already. wget is especially hard to mess up. If it isn't working I'd say it is a safe bet. An even better way is to look at your firewall setup and confirm this to be the case.

Is there any security concern we need to take note for enabling port 80 (outgoing)?

Oh yes. It isn't that doing this makes you less secure; it is that by opening this it means that if someone does gain the ability to say, inject a little javascript code into your site DB, they could use your site to commit crimes which would be very difficult to trace back to them (because all indications of who the attacker is show you as the culprit). The only thing that could really clear your name are your own logs which aren't very convincing since you provided them to the court in the first place.

I don't think I have rights to disable the firewall, please advise what would be the settings that need to be edit? Is it configure the firewall to allow port 80 outgoing?

You may be right. I cannot really tell you the answer to this because you are clearly using some sort of hosted solution. iptables is the name of the most popular Linux firewall. You should see it listed in /etc/init.d if you have it installed. If not, you'll need to go to the website for your web host and find out how it should be managed.

Comments

[Withhelds]

thanks for the answer. A few more questions. 1) May I know is there a easy way to confirm that port 80 (outgoing) is block? 2) Is there any security concern we need to take note for enabling port 80 (outgoing)? 3) I don't think I have rights to disable the firewall, please advise what would be the settings that need to be edit? Is it configure the firewall to allow port 80 outgoing?

[krowe]

@Withhelds See the updates for answers to your new questions.