Help figuring out timeout issue on certain sites

[aunlead]

Hi,

I've been facing timeout issue with certain sites for a while and cannot figure what is causing this. Looking for any advice to get to the bottom of this.

Certain sites - like Twitter.com/Tumblr.com do not load as expected as some of the CSS/images/JS files do not get downloaded - (See attachment) - they timeout. I initially suspected DNS resolution as I'm using dnscrypt (thought i messed up its config) but other sites work as expected.

I see this issues with both Asus Merlin firmware and with fork (currently on the fork) on N66-U.

How can I figure out what is causing this?

Syslog data -

May 11 01:08:51 dnscrypt-proxy[522]: Starting dnscrypt-proxy 1.4.3
May 11 01:08:51 dnscrypt-proxy[522]: Initializing libsodium for optimal performance
May 11 01:08:51 dnscrypt-proxy[522]: Generating a new key pair
May 11 01:08:51 dnscrypt-proxy[522]: Done
May 11 01:08:51 dnscrypt-proxy[529]: Starting dnscrypt-proxy 1.4.3
May 11 01:08:51 dnscrypt-proxy[529]: Initializing libsodium for optimal performance
May 11 01:08:51 dnscrypt-proxy[529]: Generating a new key pair
May 11 01:08:51 dnscrypt-proxy[529]: Done
May 11 01:08:51 dnscrypt-proxy[522]: Server certificate #1408041567 received
May 11 01:08:51 dnscrypt-proxy[522]: This certificate looks valid
May 11 01:08:51 dnscrypt-proxy[522]: Chosen certificate #1408041567 is valid from [2014-08-15] to [2015-08-15]
May 11 01:08:51 dnscrypt-proxy[522]: Server key fingerprint is 8201:4577:3D75:3934:FC25:B83C:8369:72DC:98A2:1368:AA0A:2C18:6C17:D7B4:30E8:CD63
May 11 01:08:51 dnscrypt-proxy[522]: Proxying from 127.0.0.1:65053 to 208.67.220.220:443
May 11 01:08:51 aunlead: Started dnscrypt-proxy1 from .
May 11 01:08:51 dnscrypt-proxy[529]: Server certificate #808464433 received
May 11 01:08:51 dnscrypt-proxy[529]: This certificate looks valid
May 11 01:08:51 dnscrypt-proxy[529]: Chosen certificate #808464433 is valid from [2014-09-11] to [2015-09-11]
May 11 01:08:51 dnscrypt-proxy[529]: Server key fingerprint is C863:1F2D:C621:3FE8:CD02:C65A:6DB6:DDD6:08BA:49EA:5962:AF4C:B063:6568:5A4C:9925
May 11 01:08:52 dnscrypt-proxy[529]: Proxying from 127.0.0.1:65054 to 77.66.84.233:443
May 11 01:09:25 crond[379]: time disparity of 2290779 minutes detected

drill -t txt debug.opendns.com -p 65053 @127.0.0.1
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 55255
;; flags: qr rd ra ; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; debug.opendns.com.   IN      TXT

;; ANSWER SECTION:
debug.opendns.com.      0       IN      TXT     "server 7.hkg"
debug.opendns.com.      0       IN      TXT     "flags 30 0 70 5950800000000000000"
debug.opendns.com.      0       IN      TXT     "originid 0"
debug.opendns.com.      0       IN      TXT     "actype 0"
debug.opendns.com.      0       IN      TXT     "source 117.192.16.56:33209"
debug.opendns.com.      0       IN      TXT     "dnscrypt enabled (71447764594D3377)"

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 232 msec
;; SERVER: 127.0.0.1
;; WHEN: Mon May 11 01:44:01 2015
;; MSG SIZE  rcvd: 237

And sites like https://dnsleaktest.com/ and http://phish.opendns.com/?wc=EWJvGw5mBRJDGxVuBwsG&url=www.internetbadguys.com&nref just timeout. Nothing is displayed on the browser.

I've tested on Chrome/FF/IE and on 3 different machines running Windows 7, Windows 8 and Ubuntu.

 

[aunlead]

70+ views but no suggestions.

Any help appreciated.

 

[dlugi]

Hello,
I'm new to this forum but have some exprience already fighting with similar problems

Let me guess: You are using usb modem as WAN. Am I right?
If so, r u on serial or ndis type of connection ?
What modem (if any)?

=Dlugi

 

[Mattias]

Same issue here... I can't access some sites.
If I plug the usb modem in the computer it works, but not when it's connected to my router.
In my case, I have RT-AC56U and Huawei E392u-12

 

[mstombs]

Incomplete page loads could be due to incorrect MTU - default 1500 for Ethernet WAN connections, you could try lower. Auto detection doesn't always work, and there are potential issues with MSS clamping (latest merlin has a fix in this area).

 

[Mattias]

Ok, but that is not possible. Because I'm not using dual wan and the primary WAN is USB.
So under "internet connection" were MTU settings are when you are using ethernet WAN, are not there when using USB as WAN.
There is only the USB modem settings.

 

[SebZab]

The same here when I use LTE usb modem in HiLink mode. Some pages doesn't load properly (mainly https). My solution was buying cheap tplink router and Asus works as AP client. Tp-link works properly with my Huawei e3272.

 

[dlugi]

I'm desperately trying to resolve this issue - not workaround it.
I currently have 2 asus routers: rt-n66u and rt-ac68u the issue is on both when usb is used as wan and modem is in ndis mode. When modem is switched to serial (RAS) mode then everything seems to be working just fine except for the speed - limited to ~20Mbit. I've got the same issue on tomato by shibby @ rt-ac68u when using Hilink modem. DD-wrt worked only in serial (RAS) mode so that is not an option for me.
I managed to modify Merlin firmware in the way it works with serial, qmi, cdc_ncm and Hilink Huawei modems without additional dual wan "magic" - all out of the box in ndis mode.
I made a little investigation watching tcp packets in ndis and RAS modes. Looks like problem starts when router receive frame with invalid cksum. The frame is being dropped and connection stalls. Currently, I'm trying to compare different versions of usb drivers (asus vs tplink and dovado). I believe root cause of the problem is around usbnet driver and belongings (wwan_qmi, cdc_ncm, cdc_ether).

=Dlugi

 

[dlugi]

@mstombs:
MTU for usb you can set from the router console or ssh. Just type: ifconfig <interface> mtu <new mtu>
where:
<interface> is wan interface (usb0, eth3),
<new mtu> - new mtu to be set.
It seems that on Asus you can set smaller MTU that current - this will clamp mss. if you set it back mss remains clamped.

 

[Mattias]

Tried to set it smaller... MTU size.
Did not help.

I think dlugi is on something, does this just have to do with these HiLink modems?
Let's hope you can find a solution or a fix for this(at least were the fault is). So that this can be fixed.

 

[dlugi]

Mattias,
I have the same problem on all types of modems (HiLink, CDC_NCM, QMI) except for serial (RAS).
To be honnest, I haven't seen this issue on routers other than Asus

 

[Strat]

been getting these problems for ages, going back to factory merlin image fixes it but once i start configuring it for my network it eventually start blocking certain websites... does it with current build and even older builds.

 

[aunlead]

been getting these problems for ages, going back to factory merlin image fixes it but once i start configuring it for my network it eventually start blocking certain websites... does it with current build and even older builds.

I'm still facing this issue with N66U. Tried Merlin and fork firmwares without success. In my case, using Ethernet WAN connection and not USB.

Was planning to route all my traffic through VPN to get around this issue but then realised I cannot do this cause of fwmarks issue with MIPS routers. Still looking for optimal solution.