Partial Site Frustration

[DJones]

I've xxx'd out the final bit of the WAN address, though it still appears in some of the replies.

Removed it from quotes.

 

[Phibernaut]

Tried the ISP miracle cure of leaving everything disconnected for a few minutes thinking it would grab a new WAN IP... nope. No change.

 

[KevTech]

Can the Asus recovery tool be used to reflash Merlin or should I go back to stock (first)?

Don't need to use the recovery tool to go between Merlin and Stock as you can just use the firmware upgrade page within the router.
Just factory reset the router after changing between them.

 

[drinkingbird]

Tried the ISP miracle cure of leaving everything disconnected for a few minutes thinking it would grab a new WAN IP... nope. No change.

It can take hours or even days, which is why cloning the MAC is a much quicker and easier solution. You can choose any LAN MAC, doesn't matter, in fact if you use the one of the PC you were connecting directly, your router should get the same IP that PC was getting, and that would be an excellent test to see if it now works.

Won't hurt anything, and worse case you just disable the cloning. Best process is to power off the modem, clone the MAC in the router and wait for it to finish applying, then power on the modem.

 

[DJones]

It can take hours or even days, which is why cloning the MAC is a much quicker and easier solution. You can choose any LAN MAC, doesn't matter, in fact if you use the one of the PC you were connecting directly, your router should get the same IP that PC was getting, and that would be an excellent test to see if it now works.

Won't hurt anything, and worse case you just disable the cloning. Best process is to power off the modem, clone the MAC in the router and wait for it to finish applying, then power on the modem.

For the short term if it doesn’t refresh the WAN to access the website fully he could also just access the site via a free VPN.

 

[Phibernaut]

Ah, I get what we're trying to do with the MAC Clone now. Curious to try that tonight...

I've tried connecting via work VPN (SonicWall NetExtender) and get the same result. Happy to try others (maybe outside the US?) if helpful in tracking down the hiccup.

 

[DJones]

Under wan maybe I’d also individually flip either of these to yes. Try one check if it helps, if no return to no. Spoofing I think would be the most likely thing to help(if it does). It will cause the hops to reduce by 1 which should make it appear like packets are originating from the isp modem. Honestly kinda lost as to what could be causing it if your vpn also has the issue.

 

[Phibernaut]

No change after flipping either or both TTL options.

 

[drinkingbird]

No change after flipping either or both TTL options.

Very unlikely that your TTL is running out. Those settings are for some very unique ISP cases (or trying to hack speed limits on 5G, which doesn't work anymore) and nothing would be working if your TTL was an issue.

 

[drinkingbird]

Ah, I get what we're trying to do with the MAC Clone now. Curious to try that tonight...

I've tried connecting via work VPN (SonicWall NetExtender) and get the same result. Happy to try others (maybe outside the US?) if helpful in tracking down the hiccup.

Many companies now have their VPN set up to direct non-work web traffic out your local internet so that may not mean anything.

We've gone from companies blocking split tunneling for security reasons to forcing it for cost savings (i.e. network bandwidth) reasons, total 180 in the last few years.

 

[drinkingbird]

Ah, I get what we're trying to do with the MAC Clone now. Curious to try that tonight...

I've tried connecting via work VPN (SonicWall NetExtender) and get the same result. Happy to try others (maybe outside the US?) if helpful in tracking down the hiccup.

Try cloning the MAC of the device you tried connecting directly to the modem (that successfully loaded that site). That should hopefully result in the router getting the same IP, though the lease may have expired and been given to someone else. But even if that is the case, it may get you a different subnet which should resolve the problem if it was a routing or blacklisting issue.

 

[DJones]

Try cloning the MAC of the device you tried connecting directly to the modem (that successfully loaded that site). That should hopefully result in the router getting the same IP, though the lease may have expired and been given to someone else. But even if that is the case, it may get you a different subnet which should resolve the problem if it was a routing or blacklisting issue.

Since it appears he’s getting ipv6 as well maybe disabling ipv6 altogether might help.

 

[Phibernaut]

Odd as I've read Optimum does not support IPv6. The RT-AC5300 says IPv6 is disabled though the firewall is on.

EDIT: No "Famous Server List" is selected in the IPv6 firewall section.

 

[drinkingbird]

Odd as I've read Optimum does not support IPv6. The RT-AC5300 says IPv6 is disabled though the firewall is on.

EDIT: No "Famous Server List" is selected in the IPv6 firewall section.

View attachment 51863

Whatsmyip will give you a dummy IPv6 response, ignore that, its just an IPv6 representation of your IPv4 address (that's basically what the ffff range is for). If IPv6 is disabled you aren't using it (and the firewall settings have no effect). When plugged directly in to the modem you may be using it but if your ISP doesn't support it you wouldn't be there either.

If you want to see it in action go to https://dnschecker.org/ipv6-to-ipv4.php and paste the ipv6 it gave you and you'll see it is just your v4 address. So may want to mask part of that out too if you're concerned about your IP being here.

It isn't going to be routable or be used for connecting to that site.

 

[DJones]

Odd as I've read Optimum does not support IPv6. The RT-AC5300 says IPv6 is disabled though the firewall is on.

EDIT: No "Famous Server List" is selected in the IPv6 firewall section.

View attachment 51863

I was just going by what you said earlier.

“The RT-AC5300 WAN IP says 174.44.233.xxx. That matches up with What's My IP, which says IPv6 is ::ffff:xxxxxxxx. I'll have to try connecting directly as the world permits me to take down the network again.”

If disabled then it’s a non issue.

 

[drinkingbird]

I was just going by what you said earlier.

“The RT-AC5300 WAN IP says 174.44.233.xxx. That matches up with What's My IP, which says IPv6 is ::ffff:ae2c:e9fd. I'll have to try connecting directly as the world permits me to take down the network again.”

They are the same address in different formats. So OP may want to mask the IPv6 one also. ffff is a 6 to 4 range (or 4 to 6, whatever).

 

[Phibernaut]

Huh. MAC Clone solved it - the pages now fully load! Thank you! Wonder what caused it...

Guessing I have to run "cloned" for some time until the ISP releases my prior IP. Is there any harm in doing so?

EDIT: Thinking it may not be a bad idea to do a full factory reset/restore tool/etc given all the tinkering...

 

[Phibernaut]

I rebooted, gave it a fresh Merlin install & factory reset using the "Initialize all the settings..." option and the router grabbed a new ISP IP - no MAC Cloning needed. Convenient...

I swear some of the USB Applications used to be enabled by default, but maybe that has changed. Either way, I'm glad this cleared up and appreciate everyone's attention. This site has a great group of people and I look forward to learning/contributing as part of it!

Thanks again!

 

[DJones]

Huh. MAC Clone solved it - the pages now fully load! Thank you! Wonder what caused it...

Guessing I have to run "cloned" for some time until the ISP releases my prior IP. Is there any harm in doing so?

EDIT: Thinking it may not be a bad idea to do a full factory reset/restore tool/etc given all the tinkering...

No harm in doing so. It’s normal for WAN ip addresses to change unless you’re given a strict static ip address by your ISP. Usually that’s done for businesses to host websites so that dns domain names always point to your wan ip and their is no interruption in the event that the Wan ip changes; which would be the case unless you use DDNS service that can recognize the ip has changed, but requires software installed either on your router or server to inform the domain name provider.

ISP’s that use dynamic wan ip addresses that can change, they sometimes limit users from changing their wan ip address for tracking purposes and because IPv4 addresses are limited globally and ISP’s can only own so many addresses. If they have a lot of customers they are likely saturated. And don’t have an abundant amount of unused IPv4 addresses so delaying wan ip changes making them nearly static addresses makes things less chaotic.

 

[drinkingbird]

Huh. MAC Clone solved it - the pages now fully load! Thank you! Wonder what caused it...

Guessing I have to run "cloned" for some time until the ISP releases my prior IP. Is there any harm in doing so?

EDIT: Thinking it may not be a bad idea to do a full factory reset/restore tool/etc given all the tinkering...

If the new IP you got was very similar, for example A.A.A.A didn't work but A.A.A.B does, then that one particular IP probably somehow got blacklisted by whatever site serves up the elements that were missing.

If it was a very different IP like B.B.B.B (or even A.A.B.B in some cases) then it was probably a routing issue for the original subnet, either the fault of your ISP or various other networks in the path. Its possible that it may reoccur if/when you get a new IP falling in that original subnet that wasn't working.

Cloning your MAC is often the easiest way to get a new IP when rebooting the router/modem doesn't do it (most ISPs will be "sticky" and give you the same one back for days or even weeks, makes it easier for them to track down and respond to the various RIAA/Piracy reports they get all the time). There is no harm running a cloned MAC especially if it is a MAC of a real device on your network. Even if you just totally made one up, the chances that you'd conflict with someone are low, but possible, so not a good idea. After a few days/week/month you can remove the clone, but there is no specific reason to do so.

Sounds like your ISP doesn't hold it for too long, maybe a day. Or maybe just all the testing changes you made caused them to release your lease earlier than normal.

I've seen both routing issues and blacklisting issues and cloning the MAC to get a new IP typically resolves either one. Sometimes it takes a few tries of different MACs, if it is a routing issue and they give you an IP in the same subnet (or if the whole subnet is blacklisted), it won't fix it, so you sometimes have to keep trying until you get a very different IP.

Comcast particularly is known for blacklisting an IP from being able to send emails (because it was infected with a botnet sending spam) but then assigning that IP to someone else who then can't send any emails. The biggest gripe I have with them doing that (well, other than the stupidity of not clearing the block when it goes to someone else) is that their email server will accept the email and silently drop it, no warning, so people just wonder why nobody is replying to their emails.