"
Topology
Internet
│
Rogers XB6 (Technicolor CGM4140COM)
DMZ → OPNsense WAN (10.0.0.247 via DHCP)
│
OPNsense
│
LAN
│
Single Linux laptop
The Rogers gateway is configured to place my OPNsense WAN IP (10.0.0.247) in the DMZ with reserved IP.
Symptoms
DNS resolution works.
TCP connection establishes successfully.
curl https://wikipedia.org hangs immediately after sending the TLS ClientHello.
openssl s_client also connects but never receives a ServerHello.
The same behavior occurs with multiple sites.
Example:
curl -4 -v https://wikipedia.org
* Host wikipedia.org:443 was resolved.
* Trying 198.35.26.224:443...
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
It never progresses beyond that point.
openssl s_client shows:
Connecting to 198.35.26.224
CONNECTED(00000003)
and then waits indefinitely.
Things I've already checked
MTU path tested with ping -M do and large packets succeed.
Disabled IDS/IPS completely.
Disabled hardware offloading.
Cleared firewall states.
WAN MTU override issue was corrected (I had accidentally enabled "Override MTU" on the DHCP client previously).
DNS works correctly.
Packet capture
Packet captures on both the WAN and LAN interfaces while reproducing the problem.
The interesting observation was:
The WAN interface showed the TLS connection attempt.
The LAN interface did not show the expected traffic for that same connection.
I'm not sure whether this indicates I captured on the wrong interface, whether hardware/driver behavior is affecting the capture, or whether it suggests bad configuration
Internet
│
Rogers XB6 (Technicolor CGM4140COM)
DMZ → OPNsense WAN (10.0.0.247 via DHCP)
│
OPNsense
│
LAN
│
Single Linux laptop
The Rogers gateway is configured to place my OPNsense WAN IP (10.0.0.247) in the DMZ with reserved IP.
Symptoms
DNS resolution works.
TCP connection establishes successfully.
curl https://wikipedia.org hangs immediately after sending the TLS ClientHello.
openssl s_client also connects but never receives a ServerHello.
The same behavior occurs with multiple sites.
Example:
curl -4 -v https://wikipedia.org
* Host wikipedia.org:443 was resolved.
* Trying 198.35.26.224:443...
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
It never progresses beyond that point.
openssl s_client shows:
Connecting to 198.35.26.224
CONNECTED(00000003)
and then waits indefinitely.
Things I've already checked
MTU path tested with ping -M do and large packets succeed.
Disabled IDS/IPS completely.
Disabled hardware offloading.
Cleared firewall states.
WAN MTU override issue was corrected (I had accidentally enabled "Override MTU" on the DHCP client previously).
DNS works correctly.
Packet capture
Packet captures on both the WAN and LAN interfaces while reproducing the problem.
The interesting observation was:
The WAN interface showed the TLS connection attempt.
The LAN interface did not show the expected traffic for that same connection.
I'm not sure whether this indicates I captured on the wrong interface, whether hardware/driver behavior is affecting the capture, or whether it suggests bad configuration
