X-Recipient:	archive-cygwin AT delorie DOT com
DomainKey-Signature:	a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:from:to:subject:date:message-id:references
	:in-reply-to:content-type:content-transfer-encoding
	:mime-version; q=dns; s=default; b=DyGyTPzFUn1yuDNQdTAKcnhHEDAZv
	Z/LApmcNOziWUN2VG8sNMZVJ7b/KNj+daa8yhmHj6gP+9+lNzCMFgAiCWosCH6wl
	9coTGfDlIvO/dW78XaUx04UFwO37vKaGD4rhjKQoP3foK6WGtXBPnj369NxMRtFR
	F3cQBilS+VNr4Q=
DKIM-Signature:	v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:from:to:subject:date:message-id:references
	:in-reply-to:content-type:content-transfer-encoding
	:mime-version; s=default; bh=vGso/cfy3dMerOnuBNWQ+H7SBWI=; b=jLF
	GDReoL++en/u9zqDN908NtUBBzsn6MS+TGEEZO9Fgg6Sf9IDXcst/gbqx/Ez1G1O
	B5eCDiKjE+dt+ryh7LCy0fo5vs6dc0WLDHLEhvd5y9JetKBh59Xa7a2XSwrkRrei
	/L36/38AclEG7ReSHVYHfc2LWeq3tCkTIcVFik0g=
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Authentication-Results:	sourceware.org; auth=none
X-Virus-Found:	No
X-Spam-SWARE-Status:	No, score=-2.6 required=5.0 tests=BAYES_00,MIME_BASE64_BLANKS,RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.2 spammy=spoke, Hx-languages-length:3506, house, browser
X-HELO:	esa2.dell-outbound.iphmx.com
From:	"Gluszczak, Glenn" <Glenn DOT Gluszczak AT dell DOT com>
X-DKIM:	OpenDKIM Filter v2.4.3 mailuogwprd53.lss.emc.com v3OExrXb002126
X-DKIM:	OpenDKIM Filter v2.4.3 mailuogwprd53.lss.emc.com v3OExrXb002126
To:	"cygwin AT cygwin DOT com" <cygwin AT cygwin DOT com>
Subject:	RE: What is the proper mailing list for server issues?
Date:	Mon, 24 Apr 2017 14:59:38 +0000
Message-ID:	<91DCAC3CB99C724EB365BB64677FBE7B17006C@MX204CL04.corp.emc.com>
References:	<8f4e32c2-799d-61c5-ccc3-f786bb79bf71 AT starwolf DOT com> <59902487-dd66-9004-e71f-dc2930b4f72a AT gmail DOT com> <91DCAC3CB99C724EB365BB64677FBE7B16F226 AT MX204CL04 DOT corp DOT emc DOT com> <afed718f-3add-3097-5cb0-e98a277bca54 AT starwolf DOT com>
In-Reply-To:	<afed718f-3add-3097-5cb0-e98a277bca54@starwolf.com>
MIME-Version:	1.0
X-Sentrion-Hostname:	mailusrhubprd04.lss.emc.com
X-RSA-Classifications:	public
X-IsSubscribed:	yes
X-MIME-Autoconverted:	from base64 to 8bit by delorie.com id v3OF0vMT002641

Ok, I spoke too hastily.  It's possible a webserver blocks sites or the ISP blocks.
Also, perhaps cygwin.com can't resolve starwolf.com as Brian suggested.
Looking at your curl and openssl output I see this oddity

"No ALPN negotiated"
"ALPN, server did not agree to a protocol"

According to this site cygwin.com does not support HTTP/2.  Must be using 1.1.
https://tools.keycdn.com/http2-test

Does this get you a web page?

curl -v --http1.0 https://www.cygwin.com

You're not doing any port forwarding of 443?

Glenn

============================================================

Greetings,

I'm trying from several different machines in the house, some directly connected, as well as any thru the NAT interface.  This is the ONLY site I cannot reach normally.  I have to use the Tor browser to reach the site, and, even then, once I get a new cygwin setup .exe, the list of mirrors doesn't auto-fill because (surprise, surprise) I cannot connect via any known protocol to either www.cygwin.com or 209.132.180.131.

The SSL certificates I get from a successful Tor hit and an unsuccessful
403 from home are identical

I am concluding that at least the address range 69.12.250.{40-47} are being blocked; and it probably extends beyond that.

Firewall is a Watchguard Firebox running pf_sense.  I get the 403 even with a direct (non-firewalled, non-routed connection)

I have attached two .txt file with runs from two servers within my house, one running NetBSD, one running Windows [thus the importance of cygwin].
Included are runs from 'host'/'nslookup', 'ping', 'traceroute', 'curl' 
and 'openssl'

This is NOT a local firewall issue, otherwise my other machines on different addresses would not have a problem.

smaug is my internal firewall.
stupidhead is the default next hop from said firewall.

"...it's nothing to do with cygwin.com."

Sooooo, why else would I get a refusal from the web server from this address when I can connect from elsewhere ** and the SSL certificate is the same ** ??

What am I missing?

"...but there's nothing we can do from here."

Where is "here"? If "here" == "cygwin.com", you can't tell me if my IP is on an internal blacklist (and, moreso, why?)??


On 2017-04-21 08:06, Gluszczak, Glenn wrote:
>
> Agree, it's nothing to do with Cygwin.com.
>
> Check for a firewall on your local machine.  Check your home router to see if it has a firewall with restrictions.
> Perhaps you're passing through a proxy server or firewall at the ISP?
> Try traceroute or wget to analyze what site you're really attaching to.
>
>
>
> On 4/21/2017 2:35 AM, Greywolf wrote:
>> Hello,
>>
>> I am having a server issue that neither I nor my ISP seem to be able
>> to resolve with regards to connecting to Cygwin.com -- namely, only
>> from my house, I get a 403 Forbidden.
>>
>
> This is _your_ problem.  Something has caused you to not be able to reach cygwin.com properly.  What IP address does cygwin.com resolve to?
> Does using the IP address directly work for you?
>
> $ ping cygwin.com
>
> Pinging cygwin.com [209.132.180.131] with 32 bytes of data:
>
>
>> I've been round with my ISP and they are unable to reproduce the
>> issue; the response I get from here is "contact your ISP".  So who do
>> I contact about this?  Not being able to automagically fetch the
>> mirror list is annoying, and not being able to reach the site to see
>> about updates and such is similarly so.
>>
>
> Understandable but nothing we can do from here.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

- Raw text -