HTTP/2 connections failing for specific websites

Installing and Using OpenWrt
1

I seem to be having the same issue as this thread: Some websites are inaccessible

curl -v --http2 https://www.xda-developers.com
> GET / HTTP/2
> Host: www.xda-developers.com
> User-Agent: curl/8.10.1
> Accept: */*
>
* HTTP/2 stream 1 was not closed cleanly: PROTOCOL_ERROR (err 1)
curl: (92) HTTP/2 stream 1 was not closed cleanly: PROTOCOL_ERROR (err 1)

I tried all the various suggestions and none of those helped.

My MTU on the pppoe interface is set to 1492 by default. I tried lower values, 1472, 1450, but that didn't change anything.

I checked for the MSS clamping, it was enabled. I tried disabling it, no change.

As for the other guy, it works on my mobile phone's data.

Something in OpenWrt results in this error.

ubus call system board
{
        "kernel": "6.6.65",
        "hostname": "router",
        "system": "ARMv8 Processor rev 0",
        "model": "Bananapi BPI-R4",
        "board_name": "bananapi,bpi-r4",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "SNAPSHOT",
                "revision": "r28349-47c75a25cd",
                "target": "mediatek/filogic",
                "description": "OpenWrt SNAPSHOT r28349-47c75a25cd",
                "builddate": "1734522436"
        }
}
2

Lets check for "traffic management" on providers side:

enable "drop invalid" in firewall page
Then make connreack more picky

sysctl net.netfilter.nf_conntrack_checksum=1 \
net.netfilter.nf_conntrack_tcp_be_liberal=0 \
net.netfilter.nf_conntrack_tcp_ignore_invalid_rst=0 \
net.netfilter.nf_conntrack_tcp_loose=0 # | tee -a /etc/sysctl.conf

Remove # to save for good

Now enable detailed logging of invalid packets (do not save, output may be overwhelming if they block torrents.

sysctl net.netfilter.nf_conntrack_log_invalid=255

Under normal conditions one gets few invalid packets per hour, check your log.

3

Thanks! I tried this, but nothing is shown.

I tried to dig a little deeper on my Windows client in the network behind the router.

It is actually the server, so the remote page like xda-developers.com or screenrant.com that sends an HTTP2 RST_STREAM message.

So my assumption is that something happens to the TCP communication when passing through the router. It changes something on one of the packets maybe.

4

Show it with curl. That is client to server message.

Nothing happens to tcp, it is all your provider. Make tcpdump

5

Unfortunately not. The server side sends this message and I have no idea why:

image
image1441×462 37.7 KB

This is wireshark on my PC behind the router.

I have no idea how to decrypt the SSL connection when using tcpdump.

What do you mean by this? Could you elaborate? You mean the issue happens in my ISP's network?

6

Mine goes to quic

image
image1919×270 71.2 KB

7

Yeah, that is not activated in my chrome by default.

What did you mean with the "it is all your provider" comment?

8

Why would ig/fb kick you off?

9

I do not understand the words you are saying. You mean instagram and facebook?

There are particular pages that have this issue. So far, I encountered it with screenrant.com and xda-developers.com, just like the other thread I linked in the OP.

Maybe @p9203 reads this and can tell if they found a solution. Or figured out the root cause.

10

openwrt does not alter inside ssl connection. It is something other end dislikes about you. Because of somebody in your /24 for example

Names point to amazon cloud front.