can't log on to secure website

Post by **parrot** » October 7, 2012, 7:09 pm

I'm having a problem logging on to one specific secure website. I can log on to my banking websites, both here and in the US. But when I try to log on to https://secure.tricare-overseas.com/app ... signin.htm I get the ""Could not connect to remote server
You tried to access the address https://secure.tricare-overseas.com/app ... signin.htm, which is currently unavailable. Please make sure that the web address (URL) is correctly spelled and punctuated, then try reloading the page." error message.
I've tried this on my desktop using Opera, IE9, and my Kindle Fire....all with the same results. Same problem yesterday, same problem today.

I know the website is active as a friend logged on successfully on his computer while I was talking with him on the phone. He could, I can't.

I'm using Windows 7, Microsoft essentials, no other anti-virus....and I ran Ccleaner to try and clear the 'problem'. No success. I have no problems with any other website or any other known problems with my computer......all seems to be running fine.

Any guesses out there on where next to strike my sledge hammer?

Post by **FrazeeDK** » October 7, 2012, 7:39 pm

John, when I click on the link it takes me right to the log-in website.. I had a similar problem a couple of months ago with some secure sites working properly and others "choking" and giving me a similar message. I speculated that it had something to do with my provider but was never able to prove it.. I eventually was able to get in using Google Chrome (a less "busy" browser??) and about a week later whatever the problem was, it cleared up and I was able to get into the sites using IE9 again..

Post by **parrot** » October 7, 2012, 7:44 pm

Just tried Chrome....same problem. Just logged on to two different banks, no problem. Sigh!
My friend uses a different provider....I'm using TOT. Could that be the problem?
If so, why?

Post by **FrazeeDK** » October 7, 2012, 7:54 pm

my provider is 3BB... If you're in town tomorrow drop by and try logging in from my place..

Post by **Jed** » October 7, 2012, 7:59 pm

Just tried with TOT and couldn't connect.

Used my VPN in US and connected immediately.

I have it partly because a number of US sites won't let me in from here.

But apparently others can log in from here, so may be a TOT server issue; i.e., your site not liking the TOT's IP numbers.

But tricare-overseas... you'd think they'd allow people everywhere in.

Good luck, John.

Post by **KHONDAHM** » October 7, 2012, 8:12 pm

Parrot, change your DNS server setting to 8.8.8.8 or 8.8.4.4 (Google's). That should do it.

Cheers!

Post by **BobHelm** » October 7, 2012, 8:13 pm

I could log on.
But am on 3BB as well..
As a general point my internet connection is terrible today. Significantly worse than most days with pages often failing to load.

Post by **bluejets** » October 8, 2012, 6:11 am

Not locked out in your security settings ...???

Post by **parrot** » October 8, 2012, 8:08 am

KD, can you walk me through changing my DNS settings?

BJ: My security settings are set at default level. I'm able to log on to 5 different financial institutions (here and US) and two other secure websites on a routine basis....no problem.

Post by **parrot** » October 8, 2012, 1:56 pm

We went out for our weekly lahb-fest at Uncle Mustache's restaurant (ลูงหนวด)......he offers free wifi (3BB). I logged onto the site, no problem. I've got a call into a friend at TOT who may be able to tell me why TOT won't open the site but 3BB will.

Thanks for all the advice.....at least I know it's not a problem with my setup (other than I use TOT).

Post by **KHONDAHM** » October 9, 2012, 7:42 am

Still, when on TOT, you are likely using their DNS servers. Their DNS servers suck big-time. If your buddy doesn't take care of the problem, try Googling for "How to manually change DNS Windows 7" (without quotes). You should get the info and perhaps some video demos on how to do it.

Cheers!

Post by **parrot** » October 9, 2012, 8:52 am

KD, I guess I'm hesitant about messing with something like dns......of which I know nothing about and have never messed with before.
I'm going to the TOT office this afternoon......in the meantime, if there's another TOT customer out there this morning who could try that link listed above. I'm just trying to further narrow down the possibilities before talking with the TOT engineer.

Thanks

Post by **BobHelm** » October 9, 2012, 9:36 am

Not sure if KD is correct about the TOT DNS.

However, nothing ventured, nothing gained as they say..

Here is a link to Google's instructions of how to change to their DNS numbers that KD posted above.
It is a bit on the long side to re-quote here in its totality..

https://developers.google.com/speed/pub ... docs/using

Post by **redwolf** » October 9, 2012, 4:45 pm

Parrot,

more likely, the website's servers, routers or firewalls are blocking Thai IP addresses for TOT specifically.

probably because of Intrusion attempts.

it could be a range of IP's or just your specific WAN IP (e.g. the one on your TOT DSL router).

reset your router/DSL, power off, then on after 5 minutes. that'll usually give you a new WAN IP on the DSL router, if it's a busy time of day with lots of devices going on/off the TOT network.

use this before and after to confirm if it changed. http://www.whatismyip.com/

reboot your windows machine too, like after the DSL reset.

if it was DNS (which I doubt) you would simply evade/bypass that by pinging for, obtaining, and then using the destination IP of the web server instead of the human-readable "hostname".

in this case one would:

:~$ ping secure.tricare-overseas.com
PING secure.tricare-overseas.com (12.181.161.80) 56(84) bytes of data.

then imput the IP into the browser by visiting https://12.181.161.80:443 or just https://12.181.161.80

Those are the only 2 open ports on that box. the rest of the TCP ports are filtered.

I had to use a full bore zombie scan to get through the defenses, the firewall put up a fight for 212 seconds but, well, it tried right? It was just doing it's job.

nmap –v –P0 –p 1-65535 -sI (zombie IP withheld)

Nmap scan report for secure.tricare-overseas.com (12.181.161.80)
Host is up (0.34s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp open https

Nmap done: 1 IP address (1 host up) scanned in 212.47 seconds

Redwolf Summary:

The box is up, and open on www (80) and https secure (443) ports.
Your IP is very likely blocked. Try as mentioned above.
If it was DNS all kinds of things would break. Even all the malware the hackers install into Windows every 14 minutes.
Those running PlaceRaider would be perturbed.

How to fix the IP being blocked? Better use a VPN. One that isn't also blocked. Maybe like strongvpn or something.

rw

Post by **parrot** » October 9, 2012, 8:04 pm

The TOT engineer tried accessing the link on his TOT computer and on his True smart phone. Both didn't connect. He passed the info on to the head wizards in Bangkok for resolution. Meanwhile, while having my afternoon cup of coffee at E-space, I logged on to the website again......using 3BB.
The engineer said I'd gain nothing by changing dns.......so I'll pass and hope TOT central can Roto Route out the problem using draino or whatever else works.
Thanks to all for the suggestions and in helping isolate the problem.

Post by **KHONDAHM** » October 10, 2012, 1:02 am

It doesn't sound like you guys understand why DNS should be tested as a possible cause BEFORE assuming the website or server is blocked.

DNS (Directory Naming Service) is responsible for resolving a server name to an IP address and vice versa. Without an IP address, your computer cannot connect to the remote server. Without going into a discussion of the "why", just know that not all DNS servers are created equal, and TOT's DNS servers often suck for contacting overseas servers. When you change ISPs, you are also changing DNS servers, which "may" be why it works when on other networks and not on TOT's. We want to rule DNS out definitively.

Redwolf posted (I imagine to you would be) very confusing instructions. In his instructions, he manually resolved the server name to the IP address with more effort. It is much, much simpler to simply change the DNS setting and then try to connect to the server. If you cannot connect, then you know it is not DNS and you simply change the setting back.

Here is a video demonstrating this very simple troubleshooting step. You can stop at 01:15 into the video because you do not need to do anything with your router.

Post by **redwolf** » October 10, 2012, 4:27 am

I hit the stratosphere looking to catch out a blocked IP range when I should have hovered at:

http://www.dnswalk.nu/index.php

DNSWalk shows it's not actually TOT's fault, and it's also not a blocked IP as I first surmised.

I can hit Tricare fine like everyone else not on TOT, but DNSWalk doesn't care about that in this instance, it caught out Tricare's issue, and true to KD's criticism of them, TOT's lousy DNS setup compounded the issue.

Looks like someone deleted a zone file somewhere on tricare's network, or named isn't running on a server that manages that zone file. More likely the prefix "secure." is misconfigured. I might test their base domain after this.

Checking secure.tricare-overseas.com.
BAD: SOA record not found for secure.tricare-overseas.com.
BAD: secure.tricare-overseas.com. has NO authoritative nameservers!
BAD: All zone transfer attempts of secure.tricare-overseas.com. failed!

Not so sure I would tell a user to change a network setting straight off.

Whip out some testing tools first, ones that don't need user involvement. If they get it wrong they'll be offline & then the thunder starts to rumble.

If you are going to make ANY network-oriented change, you'd be MUCH better off simply manually editing the IP for Tricare's Secure server into your /etc/hosts file in Windows with Tricare's IP as you'd not have to make a global networking change on your PC. You'd have fixed the problem in seconds until such time Tricare changed the IP which would likely never happen. PM me if needed.

Certainly not in competition with your thoughts KD and all respect intended to you. Google's free public DNS servers are an excellent addition to any PC, and if they were on there, Parrot might never have encountered the error as early as he did. He'd have ridden the cache like everyone else for a time.

I used that google DNS change as a troubleshot since year 2001 after many years prior using the same trick with Pac Bell's DNS servers. But I should have been using the proper tools & eventually did.

My techniques with PC's back then remind me of a few Thai doctors I have met. "just cut it out, everyone does, if it works, you're cured, if it doesn't you'll die as it was your time". $\:D/$

It would be interesting to see what DNSWalk says later.

Post by **redwolf** » October 10, 2012, 4:42 am

yeah, their base domain is even worse off, zone file issues in their UltraDNS config. The tech will have to go back in there & fix it.

I run UltraDNS on a few large projects. No email alerts about any outages since the 19th. Tricare tech issue. Wonder if they know.

Checking tricare-overseas.com.
FAIL: Zone transfer of tricare-overseas.com. from pdns1.ultradns.net failed: Response code from server: REFUSED
FAIL: Zone transfer of tricare-overseas.com. from pdns2.ultradns.net failed: Response code from server: REFUSED
FAIL: Zone transfer of tricare-overseas.com. from pdns3.ultradns.org failed: Response code from server: REFUSED
FAIL: Zone transfer of tricare-overseas.com. from pdns5.ultradns.info failed: Response code from server: REFUSED
FAIL: Zone transfer of tricare-overseas.com. from pdns4.ultradns.org failed: Response code from server: REFUSED
FAIL: Zone transfer of tricare-overseas.com. from pdns6.ultradns.co.uk failed: Response code from server: REFUSED
BAD: All zone transfer attempts of tricare-overseas.com. failed!

Post by **parrot** » October 11, 2012, 8:44 am

Question:
If TOT/True subscribers can't log on to the website, but 3BB subscribers can, is that an indication that the problem exists with TOT/True (I'd think) or is it the ?owner? of the website who won't allow log-ons from TOT/True?

Post by **redwolf** » October 11, 2012, 3:43 pm

parrot wrote:Question:
If TOT/True subscribers can't log on to the website, but 3BB subscribers can, is that an indication that the problem exists with TOT/True (I'd think) or is it the ?owner? of the website who won't allow log-ons from TOT/True?

I notified Tricare's tech staff about their side of the issue and they'll report back.

But it's also an issue with TOT in that their caching nameservers are set up wrong as well. It's a compound issue.

If you PM me I can walk you through a way to fix it without messing up your system settings.

btw You didn't add a proxy server in your browser recently did you?