Hi everyone. I have a web server running on my LAN, the web server has a static IP of 192.168.1.220 and it listens on port 20443 and 2080 on LAN, I have forwarded ports 443 and 80 on WAN to ports 20443 and 2080 at 192.168.1.220 on LAN.
I cannot access this website only on a single computer which is connected to my LAN network, I can ping the website on said computer, but trying to access it from the browser eventually results in a Connection Time-out, I am able to ping the website from said PC and the correct IP is returned from the ping results. Strangely, I am able to access this website when I connect to it on my phone or laptop (both use WIFI to connect to an AP that is on my LAN).
My network looks like this:
Internet
|
[PPPoE over vDSL (VLAN ID 101)]
|
|
------[VDSL (WAN) Port]---------------------------------------------------
Technicolor VDSL Bridge
-------[LAN Port 1]-[LAN Port 2]-[LAN Port 3]-[LAN Port 4]-[Eth WAN Port]-
|
[PPPoE bridged to LAN Port 1]
|
|
-----[Port 1 (WAN PPPoE)]--------------
OpenWRT Dell Optiplex
-[Port 2]-[Port 3]-[Port 4]-[Port 5]---
| | | |
---------------------------------------
LAN Network Devices and Wi-Fi routers
---------------------------------------
I have tried multiple things in order to troubleshoot and fix this issue, this includes:
- Changing the MTU for my WAN to 1472
- Using a different network card for the PC that fails to connect
- Checking that MSS Clamping is enabled (it is)
- Changing my DNS server
- Remove static address of said PC
- Reboot everything
- Manually set IP and DNS and MTU of said PC
- Remove all DHCP leases from OpenWRT
- Reconfigure the web server from scratch
All of which did nothing and the issue is still present.
Running tcpdump on said PC shows TCP retransmission errors when trying to access the website.
Running tcpdump on the router shows:
05:43:30.344542 IP my-pc.lan.43982 > website-ip.443: Flags [S], seq 830574758, win 64240, options [mss 1460,sackOK,TS val 1965301688 ecr 0,nop,wscale 7], length 0
Running tcpdump on the PC shows:
CS0 21 2.488860113 (PC LAN IP) (PUBLIC IP) TCP 74 [TCP Retransmission] 38990 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=1430460097 TSecr=0 WS=128
Running tcpdump on the webserver when connecting from said PC returns nothing.
I have ran out of ideas, after 1 day of trying to fix the issue I got nowhere.
Any ideas (except the ones I already tried) are welcome.
/etc/config/network:
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix none
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'
list ports 'eth1'
list ports 'eth2'
list ports 'eth3'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.254'
option netmask '255.255.255.0'
option ipv6 '0'
list dns '9.9.9.9'
list dns '149.112.112.112'
config interface 'wan'
option proto 'pppoe'
option username 'REDACTED'
option password 'REDACTED'
option mtu '1472'
option ipv6 '0'
option device 'eth4'
config interface 'docker'
option device 'docker0'
option proto 'none'
option auto '0'
config device
option type 'bridge'
option name 'docker0'
/etc/config/firewall:
- Web server is 192.168.1.220, NGINX is running on port 20443 and 2080 on the web server.
config defaults
option syn_flood '1'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'wan'
list network 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config zone 'docker'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option name 'docker'
list network 'docker'
config redirect
option name 'HTTPS'
option family 'ipv4'
list proto 'tcp'
option src 'wan'
option src_dport '443'
option dest 'lan'
option dest_ip '192.168.1.220'
option dest_port '20443'
option target 'DNAT'
option enabled '1'
config redirect
option name 'HTTP'
option family 'ipv4'
list proto 'tcp'
option src 'wan'
option src_dport '80'
option dest 'lan'
option dest_ip '192.168.1.220'
option dest_port '2080'
option target 'DNAT'
option enabled '1'