Diagnosis advice needed: cannot reach some specific websites

[cmangla]

I switched my ISPs modem/router to bridge mode and connected it to my router running openwrt. Openwrt router is connected using PPPoE. My ISP gives me it only an IPv4 connection.

Pretty much everything is working fine, except for the connection to some websites. For example, openwrt.org.

I doubt this is an IPv6 issue or a DNS issue, but I could be wrong. Openwrt is issueing local IPv6 address alongside IPv4 ones, but there is no IPv6 upstream, so it should not be a problem. I went to https://ipv6test.google.com , which says

No problems detected. You don’t have IPv6, but you shouldn’t have problems on websites that add IPv6 support.

Here are the output of dig and traceroute:

| => dig openwrt.org

; <<>> DiG 9.10.6 <<>> openwrt.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16583
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1452
;; QUESTION SECTION:
;openwrt.org.			IN	A

;; ANSWER SECTION:
openwrt.org.		1184	IN	A	139.59.209.225

;; Query time: 5 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Mon Dec 09 12:33:37 IST 2019
;; MSG SIZE  rcvd: 56

| => traceroute openwrt.org
traceroute to openwrt.org (139.59.209.225), 64 hops max, 52 byte packets
 1  openwrt (192.168.1.1)  4.522 ms  1.750 ms  9.428 ms
 2  120.57.112.1 (120.57.112.1)  3.547 ms  3.275 ms  11.300 ms
 3  triband-del-59.180.247.190.bol.net.in (59.180.247.190)  9.712 ms  4.406 ms  5.642 ms
 4  triband-del-59.180.210.202.bol.net.in (59.180.210.202)  3.520 ms  5.268 ms
    triband-del-59.180.210.150.bol.net.in (59.180.210.150)  5.008 ms
 5  14.143.30.81.static-delhi.vsnl.net.in (14.143.30.81)  141.099 ms  159.141 ms  160.270 ms
 6  172.23.183.121 (172.23.183.121)  155.827 ms  158.923 ms  163.797 ms
 7  ix-ae-0-100.tcore1.mlv-mumbai.as6453.net (180.87.38.5)  152.149 ms  150.010 ms  154.397 ms
 8  if-ae-5-6.tcore1.wyn-marseille.as6453.net (180.87.38.126)  144.490 ms  143.124 ms  148.866 ms
 9  if-ae-2-2.tcore2.wyn-marseille.as6453.net (80.231.217.2)  165.509 ms  158.983 ms  159.512 ms
10  if-ae-2-2.tcore2.wyn-marseille.as6453.net (80.231.217.2)  158.708 ms  154.180 ms  173.857 ms
11  if-ae-7-2.tcore2.fnm-frankfurt.as6453.net (80.231.200.78)  138.839 ms  141.854 ms  140.473 ms
12  if-ae-4-2.tcore1.fr0-frankfurt.as6453.net (195.219.87.18)  137.075 ms
    if-ae-59-2.tcore1.fr0-frankfurt.as6453.net (195.219.87.195)  155.019 ms  154.043 ms
13  195.219.50.42 (195.219.50.42)  140.711 ms  148.139 ms  141.690 ms
14  138.197.250.155 (138.197.250.155)  140.155 ms  150.657 ms *
15  wiki-01.infra.openwrt.org (139.59.209.225)  156.334 ms  162.736 ms  203.087 ms

Even ping seems fine:

| => ping openwrt.org
PING openwrt.org (139.59.209.225): 56 data bytes
64 bytes from 139.59.209.225: icmp_seq=0 ttl=56 time=179.121 ms
64 bytes from 139.59.209.225: icmp_seq=1 ttl=56 time=157.714 ms

Yet I cannot open openwrt.org from any browser. I tried this from multiple devices: Android, MacOS, Windows. I have also tried with using a wired connection to the openwrt router.

Perhaps this is an SSL issue? Here is where wget hangs:

| => wget openwrt.org
--2019-12-09 13:42:03--  http://openwrt.org/
Resolving openwrt.org (openwrt.org)... 139.59.209.225, 2a03:b0c0:3:d0::1af1:1
Connecting to openwrt.org (openwrt.org)|139.59.209.225|:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://openwrt.org/ [following]
--2019-12-09 13:42:05--  https://openwrt.org/
Connecting to openwrt.org (openwrt.org)|139.59.209.225|:443... connected.

Any suggestions on how I can further diagnose this?

[mpa]

• use larger packet sizes (1400..1500 bytes) with ping or traceroute to check for MTU issues
• make sure mtu_fix is set for the wan firewall zone
• instead of wget, use openssl s_client -connect openwrt.org:443
• run tcpdump or wireshark in parallel

[cmangla]

Based on your suggestion that the MTU might be an issue, I remembered that my ISP had set the MTU to 1480 in their HW, but I changed it to 1500. I changed it back to 1480 on their HW and also set it to the same in my openwrt router.

What that change, I can now at least get to this forum without having to use a VPN. So that's good, but some other websites now seem flaky and slow to load. For example, keep.google.com needed multiple refreshes, while gmail.com didn't have much problems.

How do I set the mtu_fix in the wan firewall zone? Is there a luci option available for that?

[mpa]

@cmangla

How do I set the mtu_fix in the wan firewall zone? Is there a luci option available for that?

Network->Firewall->Zones->MSS Clamping

[cmangla]

Ah, I see. Yes, that's set. I think the flaky connection my just be due to my ISP. I'll see how this goes. Thanks for your help @mpa .