ReadyNAS says "No IP Address": I can connect to it, but it cannot connect to Internet

[ncameron]

I was having trouble loading Spotty on LMS Web interface due to the outdated standard SSL version on this device.

Following laborious instructions on this Forum I managed to update SSL, and now I can load Spotty, BUT I can't run it - as the ReadyNAS has lost all ability to connect outside the local network.  

I can connect to it locally OK with my PC and run the Admin menu, but t cannot check for updates, cannot run Spotty, can't connect to ReadyCLOUD etc. It says "Cannot Get IP Address", even though it has a local one.

Does anyone gave any idea what's going on? It happened immediately I updated the SSL certificate - could that be the cause?

I'm assuming that I will have to RESET the device, perform a lot of Firmware updates, and live with the old SSL certificate - but Internet access is more important than seeing Spotty on the menu!  

[ncameron]

...I should add that I have:

- changed the NIC

- changed the cable

- rebooted my Router

- rebooted the ReadyNAS (several times) 

[StephenB]

Have you done any troubleshooting with ssh?

Checking the gateway configuration with

route -n | grep 'UG[ \t]' | awk '{print $2}'

---

the subnet mask with 

ifconfig

and the DNS server IPs with 

cat /etc/resolv.conf

Then also see if you can ping an external address

ping 8.8.8.8

and resolve an external dns name.

nslookup dns.google.com

[ncameron]

OK, this is weird, as they all appear to work:

route -n | grep 'UG[ \t]' | awk '{print $2}'

gets me the Router IP

ifconfig

 gets me, for the active NIC:

Link encap:Ethernet HWaddr e8:fc:af:e6:aa:f8

UP BROADCAST MULTICAST MTU:1500 Metric:1

RX Packets:0 errors:0 dropped:0 overruns:0 frame:0

TX Packets:0  errors:0 dropped:0 overruns:0  carrier:0

collisions:0 txqueuelen:1000

RX bytes:279360009 (266.4 MiB) TX bytes:118453605  (112.9 MiB)

Interrupt:19 Memory:fe800000-fe820000

cat /etc/resolv.conf

gets me:

# Generated by Connections Manager 

search home

nameserver 192.168.1.1 [the router]

nameserver 8.8.8.8

nslookup dns.google.com

 get me 8.8.8.8 and 

8.8.4.4

That all seems to be good doesn't it? 

[StephenB]

---

@ncameron wrote:

Link encap:Ethernet HWaddr e8:fc:af:e6:aa:f8

UP BROADCAST MULTICAST MTU:1500 Metric:1

RX Packets:0 errors:0 dropped:0 overruns:0 frame:0

TX Packets:0  errors:0 dropped:0 overruns:0  carrier:0

collisions:0 txqueuelen:1000

RX bytes:279360009 (266.4 MiB) TX bytes:118453605  (112.9 MiB)

Interrupt:19 Memory:fe800000-fe820000

IP is not enabled on the NIC.  You should be seeing something like

inet addr:x.x.x.x  Bcast:x.x.x.255  Mask:255.255.255.0

after between the Link encap line and the UP line for ipv4 (and potentially and inet6 addr line for ipv6).

Do any of your interfaces have the inet addr line?  (other than local loopback)

[ncameron]

I switched back to the other NIC; now I get this:

Link encap:Ethernet HWaddr e8:fc:af:e6:aa:f8
inet addr:192.168.1.32 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: 2603:7080:a403:6415:0:fc02:320:f87c/64 Scope:Global
inet6 addr: fe80::eafc:afff:fee6:aaf8/64 Scope:Link
inet6 addr: 2603:7080:a403:6415:eafc:afff:fee6:aaf8/64 Scope:Global
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:18428 errors:0 dropped:0 overruns:0 frame:0
TX packets:9198 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:3430479 (3.2 MiB) TX bytes:4358192 (4.1 MiB)
Interrupt:16 Memory:fea00000-fea20000

BUT; still get same error message with no outside access...

[StephenB]

---

@ncameron wrote:

I switched back to the other NIC; now I get this:

Link encap:Ethernet HWaddr e8:fc:af:e6:aa:f8
inet addr:192.168.1.32 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: 2603:7080:a403:6415:0:fc02:320:f87c/64 Scope:Global
inet6 addr: fe80::eafc:afff:fee6:aaf8/64 Scope:Link
inet6 addr: 2603:7080:a403:6415:eafc:afff:fee6:aaf8/64 Scope:Global
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:18428 errors:0 dropped:0 overruns:0 frame:0
TX packets:9198 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:3430479 (3.2 MiB) TX bytes:4358192 (4.1 MiB)
Interrupt:16 Memory:fea00000-fea20000

BUT; still get same error message with no outside access...

---

A lot of errors.

But did you try the other tests with the new NIC? Particularly

ping 8.8.8.8
nslookup dns.google.com

[ncameron]

They look OK:

--- 8.8.8.8 ping statistics ---
28 packets transmitted, 28 packets received, 0% packet loss
round-trip min/avg/max = 28.250/30.859/37.911 ms

root@HAL9000:~# nslookup dns.google.com
Server: 209.18.47.62
Address 1: 209.18.47.62 dns-cac-lb-02.rr.com

Name: dns.google.com
Address 1: 2001:4860:4860::8844 dns.google
Address 2: 2001:4860:4860::8888 dns.google
Address 3: 8.8.4.4 dns.google
Address 4: 8.8.8.8 dns.google

But STILL I get the comms error when the ReadyNAS tries to access the outside world. e.g. BIOS Update Check. Weird.

[StephenB]

---

@ncameron wrote:

They look OK:

But STILL I get the comms error when the ReadyNAS tries to access the outside world. e.g. BIOS Update Check. Weird.

---

This may be limited to services that use TLS/SSL.

Try 

openssl s_client -connect www.google.com:443

and see what happens. 

[ncameron]

Tried that. I get a long result which I have posted here three times, but never sticks - so I think it's too long. 

The highlights are:

CONNECTED(00000003)
depth=2 C = US, O = Google Trust Services LLC, CN = GTS Root R1
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
0 s:/CN=www.google.com
i:/C=US/O=Google Trust Services LLC/CN=GTS CA 1C3
1 s:/C=US/O=Google Trust Services LLC/CN=GTS CA 1C3
i:/C=US/O=Google Trust Services LLC/CN=GTS Root R1
2 s:/C=US/O=Google Trust Services LLC/CN=GTS Root R1
i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA

Then certificate details; then:

subject=/CN=www.google.com
issuer=/C=US/O=Google Trust Services LLC/CN=GTS CA 1C3
---
No client certificate CA names sent
---
SSL handshake has read 4901 bytes and written 415 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES128-GCM-SHA256
Session-ID: B7DFFDB1747B843CC6A897757CAA578305FA3BAF5313E281BD6DA43651763C2C
Session-ID-ctx:
Master-Key: 0F9BB680075A2F425EB86FE290C233D7345188FBD22B3EC2B18612E25F2E2E58757F41005E5D86D7FE2CC50B56EA87B8
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 100800 (seconds)
TLS session ticket:

And finally: 

Verify return code: 20 (unable to get local issuer certificate)

So it looks like in trying to update SSL I have screwed it up.  But how do I get a working certificate if I can't connect to anything?!

Thanks for all your help by the way...

[StephenB]

---

@ncameron wrote:

Tried that. I get a long result which I have posted here three times, but never sticks - so I think it's too long. 

There is an automatic spam filter, and it looks like it caught your earlier posts for some reason.  Mods review it when they have time, so you might see them released in a while.

---

@ncameron wrote:

But how do I get a working certificate if I can't connect to anything?!

---

No idea how to fix it.  You could try an OS reinstall and see if that works.  It'd be prudent to make a backup of your data, in case you lose all access.

Another thought - if you have a spare disk (not in the array), then you could do a factory install with only the spare in place.

Then copy the OS partition to an external drive.  That might help you identify the files that you modified, and get back stock files that work.

[ncameron]

Well, I was preparing myself for an inevitable OS reinstall if this wen on; it worked fine.

But now I have the same slightly broken LMS installation as before due to an outdated SSL version. However, that is preferable to no Internet access. 

Thanks for your help...