Categories
DuxTel Systems (11)
Interface Cards and Adapters (14)
Mikrotik Systems-> (157)
Mimosa Wireless (5)
RouterBOARD (11)
Router Enclosures (11)
Power Supplies & PoE-> (29)
Antennas and Accessories-> (106)
Mikrotik RouterOS (6)
Assembled Kits (6)
Carrier Wireless (1)
Cable and Misc (14)
Hardware and Mounting (23)
Configuration Library (FREE!) (7)
Quick Find
  
search products
search articles
Articles
New Articles
Case Studies
Product Guides (2)
Mikrotik Configuration (17)
Technical (5)
Community News (9)
Q&A (28)
Product Advisory (7)
Policy and Information (7)
Information
Shipping & Returns
Privacy Notice
Conditions of Use
Contact Us
http works sometimes, https usually does not connect by Mike Everest

Q: Ok , I couldn’t open http or https web pages over the router on various devices when in operation
but it allowed ping.

 
Even after defaulting it and netinstalling it, no difference.

 
It didn’t matter if it was via it’s proxy or direct , it wouldn’t behave, thus why I spent two hours trying 

to establish where the bizarre behaviour was coming from
.


A: That behaviour is usually MTU issue - solution is to clamp the maximum segment size on the pppoe output interface - here is an example:

/ip firewall mangle add protocol=tcp tcp-flags=syn action=change-mss \
      new-mss=<mss> chain=forward out-interface=<out-interface>
 
You need to change the value of <output-interface> to the output interface of your router (e.g. pppoe-out1, or ether1, etc) and the value of <mss> to match the maximum MTU size possible for that link.

This problem happens when normal MTU discovery is broken over the ISP's customer network.  You can discover the maximum packet size possible by using ping command with do-not-fragment set, and varying the frame size higher/lower until you can discover the largest packet size that will traverse the network unfragmented.  See the example below, using this method to discover that the maximum packet size for this network is 1472 bytes:
 
C:\Users\mike>ping duxtel.com -f -l 1500
 
Pinging duxtel.com [203.21.77.17] with 1500 bytes of data:
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.
 
Ping statistics for 203.21.77.17:
    Packets: Sent = 2, Received = 0, Lost = 2 (100% loss),
Control-C
^C
C:\Users\mike>ping duxtel.com -f -l 1400
 
Pinging duxtel.com [203.21.77.17] with 1400 bytes of data:
Reply from 203.21.77.17: bytes=1400 time=6ms TTL=126
Reply from 203.21.77.17: bytes=1400 time=9ms TTL=126
Reply from 203.21.77.17: bytes=1400 time=7ms TTL=126
 
Ping statistics for 203.21.77.17:
    Packets: Sent = 3, Received = 3, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 6ms, Maximum = 9ms, Average = 7ms
Control-C
^C
C:\Users\mike>ping duxtel.com -f -l 1450
 
Pinging duxtel.com [203.21.77.17] with 1450 bytes of data:
Reply from 203.21.77.17: bytes=1450 time=7ms TTL=126
Reply from 203.21.77.17: bytes=1450 time=10ms TTL=126
Reply from 203.21.77.17: bytes=1450 time=11ms TTL=126
 
Ping statistics for 203.21.77.17:
    Packets: Sent = 3, Received = 3, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 7ms, Maximum = 11ms, Average = 9ms
Control-C
^C
C:\Users\mike>ping duxtel.com -f -l 1475
 
Pinging duxtel.com [203.21.77.17] with 1475 bytes of data:
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.
 
Ping statistics for 203.21.77.17:
    Packets: Sent = 3, Received = 0, Lost = 3 (100% loss),
Control-C
^C
C:\Users\mike>ping duxtel.com -f -l 1465
 
Pinging duxtel.com [203.21.77.17] with 1465 bytes of data:
Reply from 203.21.77.17: bytes=1465 time=6ms TTL=126
Reply from 203.21.77.17: bytes=1465 time=15ms TTL=126
 
Ping statistics for 203.21.77.17:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 6ms, Maximum = 15ms, Average = 10ms
Control-C
^C
C:\Users\mike>ping duxtel.com -f -l 1470
 
Pinging duxtel.com [203.21.77.17] with 1470 bytes of data:
Reply from 203.21.77.17: bytes=1470 time=12ms TTL=126
Reply from 203.21.77.17: bytes=1470 time=19ms TTL=126
 
Ping statistics for 203.21.77.17:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 12ms, Maximum = 19ms, Average = 15ms
Control-C
^C
C:\Users\mike>ping duxtel.com -f -l 1472
 
Pinging duxtel.com [203.21.77.17] with 1472 bytes of data:
Reply from 203.21.77.17: bytes=1472 time=14ms TTL=126
Reply from 203.21.77.17: bytes=1472 time=25ms TTL=126
 
Ping statistics for 203.21.77.17:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 14ms, Maximum = 25ms, Average = 19ms
Control-C
^C
C:\Users\mike>ping duxtel.com -f -l 1473
 
Pinging duxtel.com [203.21.77.17] with 1473 bytes of data:
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.
 
Ping statistics for 203.21.77.17:
    Packets: Sent = 2, Received = 0, Lost = 2 (100% loss),
Control-C
^C
C:\Users\mike>
 

Hope it helps - questions are welcome!

 

Date Added:
Current Comments: 0
Write Review
Tell a friend
Tell a friend about this article:  
Shopping Cart
more
0 items
Latest News
about 5 days ago
LOOK! The new wsAP-lite is a dual band WiFi AP with passthrough PoE ethernet that fits into a power point profile!
more >>
about 5 days ago
The new LtAP-mini is the ideal mobile and vehicle connectivity system with GPS - add your own 4G modem for the ulti…
more >>
about 5 days ago
The cool new RBLHGG-60adkit Wireless Wire Dish Kit is on its way - available for pre-order right now!
more >>
about 5 days ago
DuxTel News: Half-price Mimosa, MikroTik LTE updates, MUM 2018 Highlights -
more >>
about 01 month ago
CCR1072-1G-8S+ - it doesn't get any better than this! Normally $4325, special price $2999 - (ex demo model, 1 unit…
more >>
about 01 month ago
ready for MikroTik Certified Training - kicking off TOMORROW! :)
more >>
about 01 month ago
MikroTik's first ever true 802.3af/at PoE switch with auto-detecting 24v/48v and 4x 10GB SFP+ uplink is available n…
more >>
about 01 month ago
Thinking about horns? See here! :)
more >>
about 01 month ago
The QuickMount-PRO includes support for the new SQT-Sq products has just arrived!
more >>
Follow our tweets for all the latest news and updates!
twitter.com/duxtel
Reviews
more
RB2011UiAS-2HnD-IN: 2011 RouterBoard with the lot!
I have worked with CISCO and Linux firewalls and routers pro ..
4 of 5 Stars!

Copyright © 2018 DuxTel Online Store