Random Timeout (Session TCP Dropped) - SOLVED

[waroz]

Hi,

It seems that I have random timeout when I am trying to connect to some website. It works fine on google, and this website, but let's say I try yahoo or wikipedia, it will timeout.

I thought it may be a DNS issue, but a capture with wireshark showed me that I correctly get A and SOA information.

This is a PPP connection.

I need help to figure out this problem. I do not know what to do.

EDIT : I can see in the live view that connections are made to the target.

EDIT 2 : After some more tests, it seems that for some reason TCP Session are randomly dropped. I captured some packets, and yes, the distant server indicated closed connection from my firewall, weird.

[waroz]

It was a strange hardware/software fault.

The internet router configured in bridge was still running at the same time DHCP4 services.
Therefore, if you go on website.tld, two things can happen:

(1) -> The traffic is ok. Nothing seems amiss.
(2) -> The distant server will observe "closed connection" with RESET. If you are capturing packets on your local machine, you will see the TCP session resurrected with a different origin, like if the connection was initiated by the router itself (and NATed by the firewall).

Of course, the live packet capture ability from Opnsense do not give much, simply stating that the outgoing connection is following the rules, so in conclusion the "resurrected TCP connection" is the normal response.

I could only deduce the problem with a traffic analysis with Wireshark.

One thing to see for example is the dropped transmission from the local side, and the answer from given with a different distant origin. It also give the false assumption that it is a DNS issue, but when seeing the dropped connection, it is not.