| View previous topic :: View next topic |
| Author |
Message |
saturnalia0
Tux's lil' helper
Joined: 13 Oct 2016
Posts: 134
|
 Posted: Mon Aug 01, 2022 11:32 pm Post subject: Cannot connect to TCP 443 on Gentoo box only |
 |
|
Weird issue discussed on the IRC channel just a while ago...
I have a home setup consisting of:
1. A modem connected to my ISP
2. A router connected to the modem
3. A PC with both Gentoo and Windows (separate SSDs) connect to the router
4. A Mac connected to the router
Only my Gentoo box cannot connect to https://proton.me (TCP 443), but I can ping it, and all other machines behind the same router (on the same network) connect successfully on TCP 443. This domain (proton.me) resolves to the same IP on all machines (so I believe it's not DNS). It is the only domain I experienced an issue with so far, other domains on TCP 443 work, including this forum:
| Code: |
gentoopc ~ # ping proton.me
PING proton.me (185.70.42.45) 56(84) bytes of data.
64 bytes from 185-70-42-45.protonmail.ch (185.70.42.45): icmp_seq=1 ttl=46 time=229 ms
64 bytes from 185-70-42-45.protonmail.ch (185.70.42.45): icmp_seq=2 ttl=46 time=227 ms
64 bytes from 185-70-42-45.protonmail.ch (185.70.42.45): icmp_seq=3 ttl=46 time=227 ms
^C
--- proton.me ping statistics ---
4 packets transmitted, 3 received, 25% packet loss, time 3503ms
rtt min/avg/max/mdev = 226.503/227.414/228.802/0.997 ms
gentoopc ~ # curl -v https://proton.me
* Trying 185.70.42.45:443...
* connect to 185.70.42.45 port 443 failed: Connection timed out
* Failed to connect to proton.me port 443 after 131733 ms: Connection timed out
* Closing connection 0
curl: (28) Failed to connect to proton.me port 443 after 131733 ms: Connection timed out
gentoopc ~ # traceroute -T -p 443 proton.me
traceroute to proton.me (185.70.42.45), 30 hops max, 60 byte packets
1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
24 * * *
25 * * *
26 * * *
27 * * *
28 * * *
29 * * *
30 * * *
gentoopc ~ # curl -v https://forums.gentoo.org
* Trying 204.187.15.6:443...
* Connected to forums.gentoo.org (204.187.15.6) port 443 (#0)
...
|
Besides curl I have tried two web browsers, to no avail.
It does not seem to be a firewall thing on Gentoo either, I only have iptables, no other firewall or AV software, and no iptables rules, with all policies set to ACCEPT on all chains:
| Code: |
gentoopc ~ # iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
gentoopc ~ # iptables-legacy-save
# Generated by iptables-save v1.8.7 on Mon Aug 1 19:32:35 2022
*filter
:INPUT ACCEPT [14345:6899356]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [9286:636792]
COMMIT
# Completed on Mon Aug 1 19:32:35 2022
gentoopc ~ # iptables-nft-save
bash: iptables-nft-save: command not found
gentoopc ~ # nft list ruleset
bash: nft: command not found
gentoopc ~ # cat /etc/hosts | grep -vPe '^#'
127.0.0.1 localhost
::1 localhost
|
Other relevant output:
| Code: |
gentoopc ~ # ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether b0:6e:bf:66:d0:a0 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.100/24 brd 255.255.255.255 scope global dynamic noprefixroute enp3s0
valid_lft 6684sec preferred_lft 5784sec
inet6 fe80::e39:b630:81da:fe28/64 scope link
valid_lft forever preferred_lft forever
3: tunl0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
link/ipip 0.0.0.0 brd 0.0.0.0
4: sit0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
link/sit 0.0.0.0 brd 0.0.0.0
|
Tried changing the MTU size as suggested by someone on IRC, to no avail:
| Code: |
gentoopc ~ # ip link set dev enp3s0 mtu 1400
gentoopc ~ # curl -v proton.me
* Trying 185.70.42.45:80...
^C
gentoopc ~ # ip a s enp3s0
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1400 qdisc pfifo_fast state UP group default qlen 1000
link/ether b0:6e:bf:66:d0:a0 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.100/24 brd 255.255.255.255 scope global dynamic noprefixroute enp3s0
valid_lft 6518sec preferred_lft 5618sec
inet6 fe80::e39:b630:81da:fe28/64 scope link
valid_lft forever preferred_lft forever
gentoopc ~ #
|
Router also has an MTU setting, set to 1500. Router has all firewall and filtering settings OFF, tried rebooting the router (and the Gentoo box).
More relevant output:
| Code: |
gentoopc ~ # ip route get 185.70.42.45
185.70.42.45 via 192.168.1.1 dev enp3s0 src 192.168.1.100 uid 0
cache mtu 576
|
Someone on IRC mentioned the above MTU output looked weird.
But wait, it gets weirder... When removing the router (connecting PC directly to the modem), it works! Gentoo can connect to https://proton.me (TCP 443). So it must be the router right? But then how come all other machines behind the router work, except Gentoo? Remember both Gentoo and Windows are running on the same PC (same network card, same cable, same socket on the router). And why just proton.me? Does not make any sense...
One guess of what might be wrong is IPV6, but I'm not sure how I would debug it.
Any ideas? |
|
| Back to top |
|
 |
saturnalia0
Tux's lil' helper
Joined: 13 Oct 2016
Posts: 134
|
| Posted: Mon Aug 01, 2022 11:48 pm Post subject: |
|
|
tcpdump while running curl (nothing else open):
| Code: |
gentoopc ~ # tcpdump
dropped privs to pcap
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on enp3s0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
20:41:50.933581 IP 192.168.1.100.56122 > one.one.one.one.domain: 29445+ A? proton.me. (27)
20:41:50.933622 IP 192.168.1.100.50953 > one.one.one.one.domain: 36841+ AAAA? proton.me. (27)
20:41:50.942627 IP one.one.one.one.domain > 192.168.1.100.56122: 29445 1/0/0 A 185.70.42.45 (43)
20:41:50.943355 IP one.one.one.one.domain > 192.168.1.100.50953: 36841 0/1/0 (75)
20:41:50.946372 IP 192.168.1.100.48318 > 185-70-42-45.protonmail.ch.https: Flags [S], seq 5931740, win 65392, options [mss 536,sackOK,TS val 315882497 ecr 0,nop,wscale 7], length 0
20:41:51.015913 IP 192.168.1.100.60175 > one.one.one.one.domain: 47361+ PTR? 1.1.1.1.in-addr.arpa. (38)
20:41:51.531127 IP one.one.one.one.domain > 192.168.1.100.60175: 47361 1/0/0 PTR one.one.one.one. (67)
20:41:51.531590 IP 192.168.1.100.53090 > one.one.one.one.domain: 1333+ PTR? 100.1.168.192.in-addr.arpa. (44)
20:41:51.540960 IP one.one.one.one.domain > 192.168.1.100.53090: 1333 NXDomain 0/0/0 (44)
20:41:51.542499 IP 192.168.1.100.53543 > one.one.one.one.domain: 40293+ PTR? 45.42.70.185.in-addr.arpa. (43)
20:41:51.551878 IP one.one.one.one.domain > 192.168.1.100.53543: 40293 1/0/0 PTR 185-70-42-45.protonmail.ch. (83)
20:41:51.974258 IP 192.168.1.100.48318 > 185-70-42-45.protonmail.ch.https: Flags [S], seq 5931740, win 65392, options [mss 536,sackOK,TS val 315883525 ecr 0,nop,wscale 7], length 0
20:41:54.022254 IP 192.168.1.100.48318 > 185-70-42-45.protonmail.ch.https: Flags [S], seq 5931740, win 65392, options [mss 536,sackOK,TS val 315885573 ecr 0,nop,wscale 7], length 0
20:41:58.054254 IP 192.168.1.100.48318 > 185-70-42-45.protonmail.ch.https: Flags [S], seq 5931740, win 65392, options [mss 536,sackOK,TS val 315889605 ecr 0,nop,wscale 7], length 0
20:42:06.310258 IP 192.168.1.100.48318 > 185-70-42-45.protonmail.ch.https: Flags [S], seq 5931740, win 65392, options [mss 536,sackOK,TS val 315897861 ecr 0,nop,wscale 7], length 0
20:42:11.430249 ARP, Request who-has 192.168.1.1 tell 192.168.1.100, length 28
20:42:11.430512 ARP, Reply 192.168.1.1 is-at 00:19:e0:64:d6:30 (oui Unknown), length 46
20:42:11.502534 IP 192.168.1.100.48821 > one.one.one.one.domain: 24506+ PTR? 1.1.168.192.in-addr.arpa. (42)
20:42:11.512424 IP one.one.one.one.domain > 192.168.1.100.48821: 24506 NXDomain 0/0/0 (42)
20:42:22.694274 IP 192.168.1.100.48318 > 185-70-42-45.protonmail.ch.https: Flags [S], seq 5931740, win 65392, options [mss 536,sackOK,TS val 315914245 ecr 0,nop,wscale 7], length 0
20:42:54.950261 IP 192.168.1.100.48318 > 185-70-42-45.protonmail.ch.https: Flags [S], seq 5931740, win 65392, options [mss 536,sackOK,TS val 315946501 ecr 0,nop,wscale 7], length 0
20:43:00.070263 ARP, Request who-has 192.168.1.1 tell 192.168.1.100, length 28
20:43:00.070484 ARP, Reply 192.168.1.1 is-at 00:19:e0:64:d6:30 (oui Unknown), length 46
^C
23 packets captured
23 packets received by filter
0 packets dropped by kernel
|
Re-run with verbose output:
| Code: |
gentoopc ~ # tcpdump -v
dropped privs to pcap
tcpdump: listening on enp3s0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
20:44:39.513231 IP (tos 0x0, ttl 64, id 63398, offset 0, flags [DF], proto TCP (6), length 60)
192.168.1.100.57978 > 185-70-42-45.protonmail.ch.https: Flags [S], cksum 0xa5ae (incorrect -> 0xddfa), seq 1434316206, win 65392, options [mss 536,sackOK,TS val 316051064 ecr 0,nop,wscale 7], length 0
20:44:39.615043 IP (tos 0x0, ttl 64, id 58841, offset 0, flags [DF], proto UDP (17), length 72)
192.168.1.100.47064 > one.one.one.one.domain: 31112+ PTR? 100.1.168.192.in-addr.arpa. (44)
20:44:39.624258 IP (tos 0x0, ttl 58, id 28463, offset 0, flags [DF], proto UDP (17), length 72)
one.one.one.one.domain > 192.168.1.100.47064: 31112 NXDomain 0/0/0 (44)
20:44:40.550269 IP (tos 0x0, ttl 64, id 63399, offset 0, flags [DF], proto TCP (6), length 60)
192.168.1.100.57978 > 185-70-42-45.protonmail.ch.https: Flags [S], cksum 0xa5ae (incorrect -> 0xd9ed), seq 1434316206, win 65392, options [mss 536,sackOK,TS val 316052101 ecr 0,nop,wscale 7], length 0
20:44:42.598254 IP (tos 0x0, ttl 64, id 63400, offset 0, flags [DF], proto TCP (6), length 60)
192.168.1.100.57978 > 185-70-42-45.protonmail.ch.https: Flags [S], cksum 0xa5ae (incorrect -> 0xd1ed), seq 1434316206, win 65392, options [mss 536,sackOK,TS val 316054149 ecr 0,nop,wscale 7], length 0
20:44:44.518250 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.1 tell 192.168.1.100, length 28
20:44:44.518444 ARP, Ethernet (len 6), IPv4 (len 4), Reply 192.168.1.1 is-at 00:19:e0:64:d6:30 (oui Unknown), length 46
20:44:44.606524 IP (tos 0x0, ttl 64, id 62696, offset 0, flags [DF], proto UDP (17), length 70)
192.168.1.100.43664 > one.one.one.one.domain: 64685+ PTR? 1.1.168.192.in-addr.arpa. (42)
20:44:44.618622 IP (tos 0x0, ttl 58, id 57957, offset 0, flags [DF], proto UDP (17), length 70)
one.one.one.one.domain > 192.168.1.100.43664: 64685 NXDomain 0/0/0 (42)
20:44:46.630262 IP (tos 0x0, ttl 64, id 63401, offset 0, flags [DF], proto TCP (6), length 60)
192.168.1.100.57978 > 185-70-42-45.protonmail.ch.https: Flags [S], cksum 0xa5ae (incorrect -> 0xc22d), seq 1434316206, win 65392, options [mss 536,sackOK,TS val 316058181 ecr
0,nop,wscale 7], length 0
20:44:54.758227 IP (tos 0x0, ttl 64, id 63402, offset 0, flags [DF], proto TCP (6), length 60)
192.168.1.100.57978 > 185-70-42-45.protonmail.ch.https: Flags [S], cksum 0xa5ae (incorrect -> 0xa26d), seq 1434316206, win 65392, options [mss 536,sackOK,TS val 316066309 ecr 0,nop,wscale 7], length 0
20:45:11.142264 IP (tos 0x0, ttl 64, id 63403, offset 0, flags [DF], proto TCP (6), length 60)
192.168.1.100.57978 > 185-70-42-45.protonmail.ch.https: Flags [S], cksum 0xa5ae (incorrect -> 0x626d), seq 1434316206, win 65392, options [mss 536,sackOK,TS val 316082693 ecr 0,nop,wscale 7], length 0
20:45:43.398261 IP (tos 0x0, ttl 64, id 63404, offset 0, flags [DF], proto TCP (6), length 60)
192.168.1.100.57978 > 185-70-42-45.protonmail.ch.https: Flags [S], cksum 0xa5ae (incorrect -> 0xe46c), seq 1434316206, win 65392, options [mss 536,sackOK,TS val 316114949 ecr 0,nop,wscale 7], length 0
20:45:48.518249 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.1 tell 192.168.1.100, length 28
20:45:48.518451 ARP, Ethernet (len 6), IPv4 (len 4), Reply 192.168.1.1 is-at 00:19:e0:64:d6:30 (oui Unknown), length 46
^C
15 packets captured
15 packets received by filter
0 packets dropped by kernel
gentoopc ~ #
|
|
|
| Back to top |
|
|
pietinger
Moderator
Joined: 17 Oct 2006
Posts: 4128
Location: Bavaria
|
| Posted: Tue Aug 02, 2022 11:06 am Post subject: |
|
|
saturnalia0,
this is really an interesting problem 
I suppose you have not a (1) modem; instead it is maybe an ADSL-Modem-Router (because you are able to connect your gentoo machine directly to it). Which model it is ?
I suppose you are using DHCP (because IP address a.b.c.100 is start of DHCP address range in most SOHo-Routers). Correct ? If yes, which machine gives DHCP address to your gentoo machine ?
Is your (2) "router" really a Router ? Or only a ethernet switch ? If it is really a router, what is its function ? Does it really routing, or only bridging ? If it does routing it must do NAT also. Here we need more information about this machine. What it is ? How it is configured ? Which IP addresses your are using on both machines (only local addresses; not your globally IP address from ADSL-Router).
Yes, something is weird with MTU ... keep in mind: A ping uses only ICMP (mtu size doesnt matter here); a session for https (port 437) uses TCP ...
I dont can promise to solve this problem, but maybe we are able to find the origin which cause the problem. Give us please as many information as possible about your two machines (1 + 2). |
|
| Back to top |
|
|
saturnalia0
Tux's lil' helper
Joined: 13 Oct 2016
Posts: 134
|
| Posted: Wed Aug 03, 2022 2:39 am Post subject: |
|
|
pietinger,
Thank you for your interest!
| Quote: |
I suppose you have not a (1) modem; instead it is maybe an ADSL-Modem-Router (because you are able to connect your gentoo machine directly to it). Which model it is ?
|
That's correct! It's a Humax HG100R-L4 provided by my ISP.
| Quote: |
I suppose you are using DHCP [...] Correct ? If yes, which machine gives DHCP address to your gentoo machine ?
|
Correct. The router is the DHCP server for the Gentoo PC (when connected to it).
| Quote: |
Is your (2) "router" really a Router ? Or only a ethernet switch ? If it is really a router, what is its function ? Does it really routing, or only bridging ? If it does routing it must do NAT also. Here we need more information about this machine. What it is ? How it is configured ? Which IP addresses your are using on both machines (only local addresses; not your globally IP address from ADSL-Router).
|
I'm not proud to admit my networking knowledge is pretty rusty and was never that good to begin with, but I believe it is in fact a router. Its function is routing traffic to/from the ADSL-Modem-Router from/to my computers. Admittedly this could be accomplished by simply connecting all the computers directly to the ADSL-Modem-Router, one in each socket, but practical reasons stand in the way - if one must know, the modem thingy is in the living room and a (single) Ethernet cable goes from it across the apartment through multiple walls up to my office. The router is used simply to connect this cable (coming from the modem thingy) to multiple computers which must have simultaneous internet access.
The router model is Multilaser ML-ROT-108, it's a local manufacturer so not sure if that's very helpful.
The IP address from the router is obtained by it from the modem thingy via DHCP, it's currently 192.168.0.26. The Gentoo PC IP is obtained from the router via DHCP, currently 192.168.1.101. I access the router from the Gentoo PC via 192.168.1.1. So yes I guess it's doing NAT, but there isn't any explicit configuration regarding NAT in the web interface.
What are you looking for in terms of configuration? There is only a web interface and it's in Portuguese, can't really share the whole thing easily. The MTU setting is set for 1500 in the router, all firewall settings are OFF.
| Quote: |
I dont can promise to solve this problem, but maybe we are able to find the origin which cause the problem. Give us please as many information as possible about your two machines (1 + 2).
|
Yeah I'm mostly curious at this point, finding the origin would be more than enough! |
|
| Back to top |
|
|
pietinger
Moderator
Joined: 17 Oct 2006
Posts: 4128
Location: Bavaria
|
| Posted: Wed Aug 03, 2022 9:04 am Post subject: |
|
|
saturnalia0,
thank you for your detailled answer. Yes, your ML-ROT-108 is really a router. My first question would be: Do you have a switch ? (Maybe "only" a cheap 8-port like e.g. TP-Link LS108G). If yes, what happens if you replace your ML-ROT-108 with a switch ? I would expect, that now all hosts will get a 192.168.0.x address (from HG100R-L4) and ... maybe ... all is working correct. (This is also a more usually solution instead two routers behind).
If this is not possible, I think it is your ML-ROT-108. Problem is here you have only a web interface to configure it (with not many choices). Can you change the mtu size on this machine (only for testing; not as a permanent solution) ? If yes, try two settings: first 1400 and if this fails then 576 |
|
| Back to top |
|
|
iuliankai
n00b
Joined: 03 Aug 2022
Posts: 1
Location: google
|
| Posted: Wed Aug 03, 2022 11:23 am Post subject: |
|
|
| mate, did you try to diable dhcp for that host and try to set ip settings manually? |
|
| Back to top |
|
|
saturnalia0
Tux's lil' helper
Joined: 13 Oct 2016
Posts: 134
|
| Posted: Thu Aug 04, 2022 10:12 pm Post subject: |
|
|
pietinger,
I do not own a switch, and changing the MTU size on the router had no effect.
iuliankai,
That worked! But why?? 
Working /etc/conf.d/net:
| Code: |
config_enp3s0="192.168.1.69 netmask 255.255.255.0 brd 192.168.1.255"
routes_enp3s0="default via 192.168.1.1"
|
Broken one:
| Code: |
config_enp3s0="dhcp"
routes_enp3s0="default via 192.168.1.1"
|
I even changed back to the broken one and rebooted, and it is in fact this that made the difference.
/etc/dhcpd.conf:
| Code: |
gentoopc ~ $ cat /etc/dhcpcd.conf | grep -vPe '^#|^$'
duid
persistent
vendorclassid
option domain_name_servers, domain_name, domain_search
option classless_static_routes
option interface_mtu
option host_name
option rapid_commit
require dhcp_server_identifier
slaac private
|
Some output after the fix:
| Code: |
gentoopc ~ $ ip route get 185.70.42.45
185.70.42.45 via 192.168.1.1 dev enp3s0 src 192.168.1.69 uid 1000
cache
gentoopc ~ $ ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether b0:6e:bf:66:d0:a0 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.69/24 brd 192.168.1.255 scope global enp3s0
valid_lft forever preferred_lft forever
inet6 fe80::b26e:bfff:fe66:d0a0/64 scope link
valid_lft forever preferred_lft forever
3: tunl0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
link/ipip 0.0.0.0 brd 0.0.0.0
4: sit0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
link/sit 0.0.0.0 brd 0.0.0.0
|
|
|
| Back to top |
|
|
pietinger
Moderator
Joined: 17 Oct 2006
Posts: 4128
Location: Bavaria
|
| Posted: Thu Aug 04, 2022 10:31 pm Post subject: |
|
|
You can look at maxmtu for both configs (good and bad) with
Maybe there is a difference.
(I dont like DHCP and it would have been the next I would have recommended, but iuliankai was faster  ) |
|
| Back to top |
|
|
bbgermany
Veteran
Joined: 21 Feb 2005
Posts: 1844
Location: Oranienburg/Germany
|
| Posted: Fri Aug 05, 2022 10:57 am Post subject: |
|
|
| saturnalia0 wrote: |
Broken one:
| Code: |
config_enp3s0="dhcp"
routes_enp3s0="default via 192.168.1.1"
|
|
Why do you set a default route with dhcp? Dont you get one from your dhcp server?
Greetings, Stefan
_________________
Desktop: Ryzen 5 5600G, 32GB, 2TB, RX7600
Notebook: Dell XPS 13 9370, 16GB, 1TB
Server #1: Ryzen 5 Pro 4650G, 64GB, 16.5TB
Server #2: Ryzen 4800H, 32GB, 22TB |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Networking & Security
