Connection issues from server to client

[Jimini]

Hello everyone,

first of all - this seems not to be a very uncommon problem, but I've been trying and researching for days now without any solution.

My agent on host.name.dyndns is listening on port 10052 and the connection is encrypted. PSK identity and PSK are stored in the host's properties in the Zabbix web GUI. My Zabbix server runs on a virtual server on the web. This setup worked for years, a few months ago I implemented encrypted connection (before, I used SSH tunnels).
Since about one week, host.name.dyndns cannot be reached anymore: "Get value from agent failed: cannot resolve [host.name.dyndns]". Telnet from my server to host.name.dyndns 10052 works fine. zabbix_get does work as well. zabbix_sender from the agent to the server does work, too. What is wrong here?
In the logs, I sometimes get "failed to accept an incoming connection: from zabbix.server.second.ipaddress: unencrypted connections are not allowed". The server has 2 IP addresses, and zabbix is bound on the first one. For some reason, it sometimes seems to use the second address.

On the server I run Zabbix 3.4.9, on the agent zabbix-agent-3.4.8-1.el7.x86_64, zabbix-release-3.4-2.el7.noarch, zabbix-sender-3.4.8-1.el7.x86_64.

Any help would really be appreciated. Thanks in advance,
Jimini

[kernbug]

Hello everyone,

My agent on host.name.dyndns is listening on port 10052 and the connection is encrypted. PSK identity and PSK are stored in the host's properties in the Zabbix web GUI.

Hi

Have you enabled encryption in the configuration file of the Zabbix Agent?
https://www.zabbix.com/documentation...re_shared_keys

[Jimini]

Yes:
TLSConnect=psk
TLSAccept=psk
TLSPSKIdentity=(key identity as set in the web GUI)
TLSPSKFile=/etc/zabbix/key.psk

The whole setup worked for months, but in the last two weeks something must have changed, wherefore the connection does no longer work.

Edit: for testing purposes, I just deactivated the encryption, which had no effect - the connection problems persist.
Edit2: I temporarily edited my iptables rules on the client and allowed all connections to and from the zabbix server. The connection was established and the zabbix server could see the client again. Afterwards, I reversed the changes, so that only the following rules were active:
iptables -A INPUT -p tcp -s FIRST.IP.OF.SERVER --dport 10050 -j ACCEPT
iptables -A INPUT -p tcp -s SECOND.IP.OF.SERVER --dport 10050 -j ACCEPT
iptables -A OUTPUT -p tcp -d FIRST.IP.OF.SERVER --dport 10051 -j ACCEPT
iptables -A OUTPUT -p tcp -d SECOND.IP.OF.SERVER --dport 10051 -j ACCEPT
The strange thing is, that it still works now.

Best regards,
Jimini