Are some hosters blocked from using public.pyzor.org?

[kguelzau]

I am running a small mail server on a server hosted by german hoster Hetzner.
It seems that traffic from this network is blocked.

Start: 2024-12-08T14:50:49+0100
HOST: host.example.org            Loss%   Snt   Last   Avg  Best  Wrst StDev
  1.|-- static.xx-xx-xxx-xxx.clie  0.0%   200    0.4   0.5   0.2   8.7   0.8
  2.|-- core12.nbg1.hetzner.com    0.0%   200    0.7   1.6   0.3  38.5   4.3
        core11.nbg1.hetzner.com
  3.|-- juniper4.dc2.nbg1.hetzner  0.0%   200    0.7   1.8   0.4  39.6   5.1
        juniper4.dc2.nbg1.hetzner.com
  4.|-- ???                       100.0   200    0.0   0.0   0.0   0.0   0.0
  5.|-- be6039.rcr71.nue01.atlas.  0.0%   200    2.1   2.8   1.3  26.5   4.2
  6.|-- be6038.ccr22.muc03.atlas.  0.0%   200    3.4   6.0   2.8  74.5  10.5
        be6037.ccr21.muc03.atlas.cogentco.com
  7.|-- be5516.ccr41.fra05.atlas.  0.0%   200    8.4   9.3   8.3  46.6   4.9
        be5517.ccr41.fra05.atlas.cogentco.com
  8.|-- be5340.ccr42.ams03.atlas.  0.0%   200   15.0  21.0  14.8 217.1  27.5
        be3343.ccr41.ams03.atlas.cogentco.com
  9.|-- be2278.rcr21.b038092-0.am  0.0%   200   15.9  16.4  15.0  70.3   5.3
        be2283.rcr21.b038092-0.ams03.atlas.cogentco.com
 10.|-- 149.11.201.122             0.0%   200   15.8  15.5  15.1  16.0   0.2
 11.|-- ???                       100.0   200    0.0   0.0   0.0   0.0   0.0

What can I do to unblock traffic?
Are there any other public or paid pyzor servers?

update:
Traffic from/to public.pyzor.org:24441 ist not blocked by pyzor.
I blocked (did not allow) incoming UDP packets in the hetzner firewall config.

[mnalis]

You cannot use "mtr -u" to determine if pyzor works (because reasons¹).

E.g. my pyzor works, yet it still ends with:

  9.|-- 149.11.201.122             0.5%   200   28.0  28.3  27.6  29.4   0.3
 10.|-- ???                       100.0   200    0.0   0.0   0.0   0.0   0.0

Instead, you should use pyzor ping which (given properly configured ~/.pyzor/*) will give output like:

$ pyzor ping
public.pyzor.org:24441  (200, 'OK')
82.94.255.100:24441     (504, 'Reading response timed-out.')
[...]

helping you determine if it works.

Footnotes

1. mtr can only detect if packet sent to some UDP port returns ICMP TTL exceeeded (indicating we have not yet reached our server), return some other administratively prohibited ICMP or similar, returns an actual answer to the source UDP port, or does not return anything.
   As UDP does not have protocol-level replies (like e.g. TCP has with its 3way-handshake), if you "did not get an answer", you may not assume anything (like that the port is unreachable, or that server is not running etc). It may well be that the server just didn't want to reply to you (for example, because you provided invalid query data in your original packet -- and as mtr does not know how to format packet specifically for pyzor servers, that is certainly the case. Try sending random-content UDP/53 packets to a.root-servers.net DNS servers, and they'll also likely not deign to return any answer to you -- and yet you can be assured those are quite probably working and reachable, if your machine has any usable network connectivity). ↩

[kguelzau]

Mhh, ok good explanation @mnalis.
How does PortQry report LISTENING on my windows client?

> PortQry -n public.pyzor.org -e 24441 -p UDP
Querying target system called:
 public.pyzor.org
Attempting to resolve name to IP address...
Name resolved to 154.61.86.89
querying...
UDP port 24441 (unknown service): LISTENING

On the server (linux) I have a timeout

# pyzor -t 30 ping
public.pyzor.org:24441  (504, 'Reading response timed-out.')

So the actual question is still valid.
Does the public pyzor server block traffic from some hosters and can I do something to change it?

The support ticket (Hetzner) response was something like "They do not block this traffic and got no answer on contact".

[mnalis]

Sorry, no idea about Microsoft tools or APIs they use and what they might be reporting and why. 🤷‍♂️
If any case I would not expect them to be useful at all (any more than mtr -u was), as those limitations are due to the nature of UDP protocol itself, and not due to specific tools used for probing.

As for the debugging:

• that pyzor server should respond to regular ICMP echo requests, i.e. ping -n -c3 154.61.86.89 should work. Does it for you?
• If not, what does regular mtr -b 154.61.86.89 say?
• Do you have any local firewall on that Hetzner VPS (and is it trying to filter anything related to UDP or ICMP - and if so, does pyzor work if you disable that)? (e.g. does iptables-save return anything?)
• How about Hetzner VPS managment firewall if that is available/enabled?
• Are you seeing traffic going out on the wire and back in (tcpdump -npi any host public.pyzor.org -v)?

[kguelzau]

Oh dear, it was indeed the managed firewall.
I needed to add an incoming rule for the udp traffic of pyzor, since it's a stateless firewall without "udp sessions".

Thanks a lot @mnalis for your help!