Cannot access bitbucket.org website, or push to git repo

[Richard Creek]

Atlassian's status page is showing Bitbucket as up, but I'm unable to see the bitbucket.org website and I can't push to my git repo.
I've been working with repos in bitbucket for years and have never had this issue before, and I haven't changed any firewall settings or anything like that.

When I try to do an ssh push whilst on my fibre connection I see:
kex_exchange_identification: read: Connection reset by peer

When I switch to using a 4g connection via my phone as a hotspot I see:
ssh: connect to host bitbucket.org port 22: Network is unreachable

The website gives: ERR_ADDRESS_UNREACHABLE

I don't think my IPs can be the problem as both my phone and fibre connection have dynamic ips.

I've tried: telnet bitbucket.org 22, that gives: Connection closed by foreign host.

I'm not having any trouble accessing atlassian's site, or Trello, it's just bitbucket.org that I can't access.

Any one else having this problem?

P.S. I'm in the UK

P.P.S Three days later and still no access to website or repos. I've looked at whois for bitbucket.org and found the primary nameserver, tried dig on that and got the A record and put it in my hosts file and it makes no difference

[Richard Creek · Accepted solution]

Note to self: Always check the hosts file properly.

[Theodora Boudale]

Hi Richard and welcome to the community!

There hasn't been any incident that would make our website inaccessible or affect SSH connections during the last three days.

If you have tried two different networks, the issue may be specific to that computer. Can you open bitbucket.org from your mobile device's browser, when it is connected to one of the two networks you have tried with your computer?

We have deprecated certain IPs for Bitbucket Cloud. You can see in the link below which IPs we have deprecated and which ones we currently use:

• https://support.atlassian.com/bitbucket-cloud/docs/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall/

I suggest removing from the hosts file all entries (check if there are additional ones, other than the one you recently added) that map bitbucket.org to a specific IP address and try again.

Kind regards,
Theodora

[Richard Creek]

Thanks Theodora,

I've tried with a browser directly in my phone and that is seeing the site - even using the same connection as the desktop.

My desktop still wont open the site though, I've tried with Chrome, Firefox and Opera - all the same.

I've looked at that list of IP's you linked to. My DNS is pulling in one of the deprecated ones: 104.192.141.1

So, I've tried the non-deprecated ips in my hosts file and that made no difference either. I removed the host file entries and that made no difference.

ping bitbucket.org works and it's using 104.192.141.1

traceroute bitbucket.org is failing after a few hops e.g.

traceroute to bitbucket.org (104.192.141.1), 30 hops max, 60 byte packets
1 _gateway (192.168.1.254) 0.769 ms 1.049 ms 1.287 ms
2 * * *
3 * * *
4 31.55.187.176 (31.55.187.176) 12.043 ms 12.101 ms 31.55.187.180 (31.55.187.180) 12.270 ms
5 core1-hu0-12-0-3.southbank.ukcore.bt.net (195.99.127.44) 12.335 ms core1-hu0-16-0-8.southbank.ukcore.bt.net (213.121.192.92) 12.617 ms host213-121-192-106.ukcore.bt.net (213.121.192.106) 12.098 ms
6 peer8-et-4-0-5.telehouse.ukcore.bt.net (194.72.16.162) 12.345 ms peer1-et7-0-2.interxion.ukcore.bt.net (194.72.16.118) 9.427 ms peer2-et-0-1-2.slough.ukcore.bt.net (109.159.252.124) 15.502 ms
7 195.99.126.11 (195.99.126.11) 10.133 ms 99.82.181.174 (99.82.181.174) 10.971 ms *
8 * * *
...
30 * * *

I've used the tool recommended in the Atlassian trouble shooting: Customer Routing from NTT

That's showing:

inet.0: 966785 destinations, 8394080 routes (965494 active, 15192 holddown, 1341538 hidden)
+ = Active Route, - = Last Active, * = Both

A V Destination        P Prf   Metric 1   Metric 2  Next hop        AS path
* ? 81.128.0.0/11      B 170        100 4294967294                  1299 5400 2856 I
  unverified                                       >129.250.4.23
  ?                    B 170        100 4294967294                  1299 5400 2856 I
  unverified                                       >129.250.4.23
  ?                    B 170        100 4294967294                  1299 5400 2856 I
  unverified                                       >129.250.4.23
  ?                    B 170        100 4294967294                  3356 5400 2856 I
  unverified                                       >129.250.2.125
  ?                    B 170        100 4294967294                  3356 5400 2856 I
  unverified                                       >129.250.2.125
  ?                    B 170        100 4294967294                  3356 5400 2856 I
  unverified                                       >129.250.2.125

I'm using Ubuntu 20.04 on the desktop. Do you know of any recent Ubuntu updates that could have caused three different browsers to only have trouble connecting to bitbucket.org?

thanks again for your help.

[Richard Creek]

I've tried checking the connection to https://bitbucket.org with curl 

$ curl -v https://bitbucket.org     
*  Trying 104.192.141.1:443...
* TCP_NODELAY set
* Connected to bitbucket.org (104.192.141.1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*  CAfile: /etc/ssl/certs/ca-certificates.crt
 CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* OpenSSL SSL_connect: Connection reset by peer in connection to bitbucket.org:443 
* Closing connection 0
curl: (35) OpenSSL SSL_connect: Connection reset by peer in connection to bitbucket.org:443

A similar curl against Trello.com works, Trello is also using TLSv1.3

 Could bitbucket have been changed to use a different cypher set recently that is making it inaccessible to ubuntu 20.04 with openssl 1.1.1f?

[Richard Creek]

Testing with openssl I'm seeing the following.

openssl s_client -connect bitbucket.org:443 -prexit -servername bitbucket.org
CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 305 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 305 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

[Richard Creek]

Oh boy, how embarrassing. I'd added the hosts file entry at the bottom of my host file when I started having the problem, then commented it out.

There was another entry at the top of the file for one of the deprecated IPs.

[Theodora Boudale]

Hi Richard,

I was about to reply, when I saw your update. It's good to hear that you found the entry!

Even though the issue was not related to security protocols, you can find supported TLS protocols and cipher suites on this page:

• https://support.atlassian.com/security-and-access-policies/docs/supported-security-protocols-for-atlassian-cloud-products/

Please feel free to reach out if you ever need anything else.

Kind regards,
Theodora