Asus RT-N66U just could not connect to one web site

[lbd.patrician]

I have a RT-N66U running merlin firmware. However, it just could not connect to one web site, the reset of websites are OK. If I connect my computer directly to the modem, the connection to the web site is OK. If I connect through the router, the connection to the web site is not accessible.

The web site:
http://pan.baidu.com

I tried different version of the firmwares, neither of them works for this web site.

Please help me on debugging and fixing this issue.

Thanks a lot.

 

[Nullity]

Looks like an inaccessible site to me.

http://www.downforeveryoneorjustme.com/pan.baidu.com

 

[john9527]

Works for me....(I can't read it though)

 

[Nullity]

Hmm.

HTTPS works, but not HTTP.

 

[lbd.patrician]

Yes, https works for me too. However, if I don't use the router (connecting the modem directly), I can connect it using http. Also, I can connect it through http on my cell phone (using LTE) and my office computer.

I am wondering what is going on inside the router.

 

[KevTech]

Works fine for me with http or https.

 

[john9527]

Works fine for me with http or https.

Same here....

 

[Nullity]

My ISP is Windstream and my router is pfSense.

I can only access TCP port 443. Port 80 times out. Ping works fine. This does not seem like a routing problem.

Perhaps their firewall filters by IP block? My IP is currently 173.187.*.*

 

[lbd.patrician]

Then how to explain that I can connect it through http if I connect my laptop directly to the cable modem?

Do you mean router's firewall, modem's firewall or ISP's firewall?

I disabled firewall on the router side.

My ISP is Windstream and my router is pfSense.

I can only access TCP port 443. Port 80 times out. Ping works fine. This does not seem like a routing problem.

Perhaps their firewall filters by IP block? My IP is currently 173.187.*.*

 

[Nullity]

Then how to explain that I can connect it through http if I connect my laptop directly to the cable modem?

Good point...

Do you mean router's firewall, modem's firewall or ISP's firewall?

I disabled firewall on the router side.

The firewall used by pan.baidu.com



Considering that the site is a login, maybe HTTPS is being forced for security reasons. I connect instantly via HTTPS. Perhaps those who are successfully connecting via HTTP are the ones with the misconfiguration.

Can you guys who can connect via HTTP please verify that TCP port 80 on pan.baidu.com is actually accepting connections by using netcat or telnet? (ex. "nc -v pan.baidu.com 80")

UDP port 80 is open. Perhaps the site uses QUIC, which uses UDP instead of TCP. I think QUIC requires a minimum MTU of 1350, and mine is 1280, probably meaning no QUIC.

@lbd.patrician
What is your MTU?

Edit: Chrome does not enable QUIC by default, so forget my QUIC theory.

 

[lbd.patrician]

Good point...



The firewall used by pan.baidu.com



Considering that the site is a login, maybe HTTPS is being forced for security reasons. I connect instantly via HTTPS. Perhaps those who are successfully connecting via HTTP are the ones with the misconfiguration.

Can you guys who can connect via HTTP please verify that TCP port 80 on pan.baidu.com is actually accepting connections by using netcat or telnet? (ex. "nc -v pan.baidu.com 80")

UDP port 80 is open. Perhaps the site uses QUIC, which uses UDP instead of TCP. I think QUIC requires a minimum MTU of 1350, and mine is 1280, probably meaning no QUIC.

@lbd.patrician
What is your MTU?

The MTU is 1500. The Authentication is "None".

 

[john9527]

Then how to explain that I can connect it through http if I connect my laptop directly to the cable modem?

When you connect via the laptop vs the modem you will most likely get two different external ip addresses.

 

[silvercloud]

That is unlikely accept if u reboot the modem. The most probable thing is different dns settings

 

[Nullity]

That is unlikely accept if u reboot the modem. The most probable thing is different dns settings

If your modem is bridged, you will most likely get a new IP because the router, not the modem, is the one with the external IP.

If your modem is still functioning as a router (bad idea), then your IP will probably stay the same, because the modem is assigned the IP.


DNS settings would not cause what we are experiencing.

I blame the site itself.

 

[silvercloud]

You should try trace route to find out more. I still guessing it's the dns. Some dns often is dns block some websites

 

[silvercloud]

I mean isp dns. You could try tunneling to Chinese proxy