Facebook owned sites blocked when syncookies are used.

[sja1440]

Facebook owned sites, including whatsapp.com, are effectively blocked when setting:

Code Select Expand

Firewall->Settings->Advanced->Enable syncookies = always

No other site seems to be affected.

Using Wireshark on the WAN connection from my Opnsense box to my modem shows that, with syncookies enabled, no response is obtained from facebook owned sites for the transmitted Opnsense reconstructed SYN.

I do not know whether facebook et al object to the constant tcp sequence number of 64240 as reported  here: https://forum.opnsense.org/index.php?topic=34236.0 or because  tcp options are removed from the SYN by the syncookie mechanism.

The problem is resolved by setting

Code Select Expand

Firewall->Settings->Advanced->Enable syncookies = none

Edited: Version is OPNsense 23.1.8-amd64