Approach to troubleshoot a very slow connection to a single website. - solved

mervincm

Attempt number 2
2.5.0-DEVELOPMENT (amd64)
built on Tue Nov 19 18:35:12 EST 2019

I am consistently unable to reach a specific public website from behind my pfSense firewall. It works fine via LTE, or if I bypass my pfsense router. It should load in less than 1 second, but it takes minutes and never appears to complete.

It does not seem to be DNS as I can resolve the hostname via the client device and the page does partially load
ping is not useful as this host appears to block icmp.

no pfblocker package loaded,

I am not sure what to look at next.

looking at the firewall rules / LAN, I see the three base rules (anti-lockout, default allow LAN ipv4 and ipv6)

kiokoman

could be MTU, you need to analyze the traffic with packet capture / wireshark

NogBadTheBad

What is the web site ?

mervincm

@NogBadTheBad
https://meet.alberta.ca
It is cisco virtual meeting VC for a customer of mine.
it loads virtually instantly everywhere I try it other than through my pfsense firewall.

ikifar

Contact your ISP?
What are you running pfSense on?
Your not in a double NAT are you?

NogBadTheBad

@mervincm

Looks fine from behind my pfSense router:-

Screenshot 2019-11-20 at 16.32.56.png

Pippin

Try ticking "IP Do-Not-Fragment compatibility"

mervincm

@Pippin I will look that up and test, thank you for the suggestion.

mervincm

@ikifar I don’t think it’s the ISP because when I bypass the pfSense firewall by plugging the test PC directly to the ISP link (thus on a public IP address) the problem goes away.

JKnott

@Pippin said in Approach to troubleshoot a very slow connection to a single website.:

Try ticking "IP Do-Not-Fragment compatibility"

I just looked that up in the docs and found this:

"This option is a workaround for operating systems that generate fragmented packets with the don’t fragment (DF) bit set. Linux NFS (Network File System) is known to do this, as well as some VoIP systems.

When this option is enabled, the firewall will not drop these malformed packets but instead clear the don’t fragment bit. The firewall will also randomize the IP identification field of outgoing packets to compensate for operating systems that set the DF bit but set a zero IP identification header field."

Given an OS fragmenting before sending and setting the DNF is entirely normal, doesn't this reflect a bug with pfSense/FreeBSD? No router should be changing that flag.

Pippin

I don't know if it is a bug.
It solved my problem described in the link so I just had a hunch:
https://forum.netgate.com/topic/138124/posting-to-a-forum-issue/21

mervincm

@ikifar no double NAT, and dedicated hardware
https://www.newegg.ca/gigabyte-ga-c1007un-d-mini-itx/p/N82E16813128598

ikifar

@mervincm Ok well I am able to visit the site here at home and I am running pfSense, I assume you don't have any caching so that can't be the issue. Maybe try the file system check to get to this in the pfsense console select the option to reboot (5) then select the option to do a filesystem check which should be F

johnpoz

@mervincm said in Approach to troubleshoot a very slow connection to a single website.:

(thus on a public IP address) the problem goes away.

But this public ip address changes right... Do what @NogBadTheBad did and lets see what your browser says about the loading and where the problem is..

mervincm

@Pippin thanks for the hint but it didn't make a difference.

mervincm

@johnpoz
I happen to have a mac so I pulled up safari - web inspector and I get a the same issue. It records for about 12 seconds and stops thinking the page is loaded, but it's a good minute at least from complete.
Screen Shot 2019-11-20 at 8.35.13 PM.png Screen Shot 2019-11-20 at 8.37.42 PM.png Screen Shot 2019-11-20 at 8.38.45 PM.png