Issue: The user was able to access the OCI instance until yesterday, but today the server is unreachable and login attempts are failing. This is a critical issue because a monthly health check report must be delivered to the client within the next 30 minutes.

As an OCI Engineer, follow the below troubleshooting steps to identify and resolve the issue.

• Verify when the issue started.
• Determine whether it is a new deployment issue or an existing server that suddenly became inaccessible.

• Source IP Address (User's Public IP)
• Destination IP Address (OCI Instance IP)

• Is the user connecting through the Public IP?
• Is the user connecting through the Private IP using VPN or Bastion Host?

Verify that the instance is in a RUNNING state.

Verify there are no ongoing OCI service outages affecting the region.

Use ping to verify Layer 3 connectivity.

ping <instance-ip>

Note: If ping fails, ICMP may be blocked by a firewall. Continue with port connectivity testing.

Verify that the required port is accessible.

Examples:

• SSH → 22
• HTTP → 80
• HTTPS → 443
• Oracle Database → 1521

telnet <instance-ip> <port>

Example:

telnet <instance-ip> 22

Check the Security Lists (SL) and Network Security Groups (NSG) associated with the instance.

• Required Ingress Rule exists.
• Required Egress Rule exists.
• Source IP is allowed.
• Destination Port is allowed.

Check the Route Table attached to the subnet.

For public access:

0.0.0.0/0 → Internet Gateway

Ensure the correct route is configured.

If OCI networking is configured correctly but connectivity still fails, check the operating system firewall.

systemctl status firewalld

firewall-cmd --list-all

firewall-cmd --list-ports

If all OCI and server-side checks are successful, the issue may be on the user's local machine or network.

Share the results of the troubleshooting performed:

• Successful ping results
• Successful telnet results
• Security List and NSG validation
• Route Table validation
• OCI Region Health showing no outages

The OCI Security Rules are configured correctly and allow inbound traffic to reach the server. However, the connection may still fail if outbound traffic from your local machine is being blocked by a local firewall, corporate network security policy, proxy, or ISP restrictions. In such cases, the request never reaches the OCI instance, even though the server is configured to accept the connection.

"Our diagnostics confirm that the OCI Instance is running normally and its firewalls are actively configured to accept your incoming connection (Inbound Traffic Allowed). However, your connection attempt is being dropped before it reaches the cloud. This indicates that your local device firewall, corporate network policy, or ISP security suite is restricting your device from making outbound connections to external public IPs on this specific port (Outbound Traffic Restricted).

Next Steps: Please reach out to your local IT infrastructure or network security team to whitelist outbound traffic targeting the OCI destination IP on the required port."

• Corporate Firewall Restrictions
• Local PC Firewall
• Endpoint Security Software
• VPN Issues
• ISP Restrictions

Follow the troubleshooting steps in the following order:

1. Verify Instance Status
2. Test Ping Connectivity
3. Test Port Connectivity
4. Validate Security Lists and NSGs
5. Verify Route Tables
6. Check OS Firewall
7. Investigate Client-Side Restrictions

This approach helps quickly identify whether the issue is related to OCI networking, server configuration, or the client's local environment.