Approach to troubleshoot a very slow connection to a single website. - solved

[NogBadTheBad]

@mervincm

Looks fine from behind my pfSense router:-

[Pippin]

Try ticking "IP Do-Not-Fragment compatibility"

[mervincm]

@Pippin I will look that up and test, thank you for the suggestion.

[mervincm]

@ikifar I don’t think it’s the ISP because when I bypass the pfSense firewall by plugging the test PC directly to the ISP link (thus on a public IP address) the problem goes away.

[JKnott]

@Pippin said in Approach to troubleshoot a very slow connection to a single website.:

Try ticking "IP Do-Not-Fragment compatibility"

I just looked that up in the docs and found this:

"This option is a workaround for operating systems that generate fragmented packets with the don’t fragment (DF) bit set. Linux NFS (Network File System) is known to do this, as well as some VoIP systems.

When this option is enabled, the firewall will not drop these malformed packets but instead clear the don’t fragment bit. The firewall will also randomize the IP identification field of outgoing packets to compensate for operating systems that set the DF bit but set a zero IP identification header field."

Given an OS fragmenting before sending and setting the DNF is entirely normal, doesn't this reflect a bug with pfSense/FreeBSD? No router should be changing that flag.

[Pippin]

I don't know if it is a bug.
It solved my problem described in the link so I just had a hunch:
https://forum.netgate.com/topic/138124/posting-to-a-forum-issue/21

[mervincm]

@ikifar no double NAT, and dedicated hardware
https://www.newegg.ca/gigabyte-ga-c1007un-d-mini-itx/p/N82E16813128598

[ikifar]

@mervincm Ok well I am able to visit the site here at home and I am running pfSense, I assume you don't have any caching so that can't be the issue. Maybe try the file system check to get to this in the pfsense console select the option to reboot (5) then select the option to do a filesystem check which should be F

[johnpoz]

@mervincm said in Approach to troubleshoot a very slow connection to a single website.:

(thus on a public IP address) the problem goes away.

But this public ip address changes right... Do what @NogBadTheBad did and lets see what your browser says about the loading and where the problem is..

[mervincm]

@Pippin thanks for the hint but it didn't make a difference.

[mervincm]

@johnpoz
I happen to have a mac so I pulled up safari - web inspector and I get a the same issue. It records for about 12 seconds and stops thinking the page is loaded, but it's a good minute at least from complete.

[mervincm]

and here is what it looks like from the same system, but connected to LTE

and directly to my ISP

[ikifar]

@mervincm Well do you have anything like squid that could be breaking https

[mervincm]

@ikifar
the only packages I have installed are acme,bandwidthd,openvpn-client-export,RRD_Summary

I might have run snort on this install but that would have been a couple years back.

[ikifar]

@mervincm so snort is definitely not on the system then

[ikifar]

@mervincm does the website work as expected on the stable version of pfSense in your setup?

[mervincm]

@ikifar I will try a fresh install on a spare HDD on the weekend if I can't get this going by then.

[mervincm]

@mervincm

On a spare test system I installed stable version of pfsense, created a fresh xml backup on main system, restored it to the test system, and the issue was gone.

Wondering if it was a stable 2.4 vs 2.5 issue, I then did an in-place update to the test system, taking it to 2.5 dev. The issue was still gone.

I am not sure if it is a hardware issue, or just a currupt install, but the next step will be to blow away my install on the primary system, restore from backup, and see what happens.

[mervincm]

@mervincm
Well it appears to be hardware specific. I reinstalled from scratch today's dev build on the primary system hw and without even restoring my config, the problem is there.

[johnpoz]

Hardware makes no sense to be honest.. More likely you got a different connection from your isp, because when you changed to different system your mac address would be different and you would get a different IP.

If it was hardware - why would it not be on like all sites.. Your just moving packets, pfsense doesn't even know what is the packets. It just moves them.. Pfsense doesn't know what site your talking to..