The Connection was reset

[TanyaC]

For the past several months I've been having an increasing number of websites return a "connection reset" error. I'm up to about 50 sites now. News sites, online retailers, forums sites, you name it; the error is non-discriminatory.

Except for one aspect - it only happens to http:// websites.
And it only happens OFF vpn.

I initially thought it was a browser problem. I use Firefox. But I tried Chrome, IE and palemoon. All exhibit the same problems (Except IE which just hangs). I spent months working with Mozilla to address the issue, but it seems it's not a browser issue.

Of course, I tried all the browser related stuff like clearing cache, removing extensions and add-ons, running in safe mode and so on.

I've tried with virus software disabled, windows firewall turned off, and with a very basic config in the RT-AC87U. (No filters, IP blocks etc).

So then I plugged in a 10 year old D-Link DIR-655 router I had lying around. BAM! Problem solved.

So here's what happens.

ALL PCs in this house (there are 8). Exhibit these symptoms

1. Access to a growing list of http:// websites returns a connection reset error
2. Steam community is inaccessible.
3. Netflix content vanishes and is not searchable. (Requires a detailed explanation if interested).

If the website has a https:// version we can access that. Sometimes they won't load properly and formatting is broken. If we try to access a website that does not have a https:// version we're out of luck. The website is inaccessible.

The problem also exists if I use the IP address to access the site.

Now to complicate matters, if we use a VPN the http:// sites become accessible, Netflix works properly, as does the Steam community site.

The VPN is not using any third party drivers or software. I've simply created a L2TP/IPSec connection in the network and sharing center. My VPN provider uses the Ruby interpreter, which my virus program quite rightly treats as malware, and they need a total of 8 processes to make the client work, so that's why I resorted to the natively supported windows configuration.

I'm on the latest firmware.

I've even tried reinstalling Windows from scratch on one PC and one Laptop.

Here's a sample of websites..

http://www.asrock.com/mb/
http://www.staticice.com.au
http://www.dvdfab.cn/
http://forums.mozillazine.org/viewforum.php?f=38
http://www.lmc.com.au/
http://readingcinemas.com.au/home
http://thetvdb.com/
http://www.gskill.com/en/
http://www.mrexcel.com/forum/
http://au.billion.com/
http://www.adsl2exchanges.com.au/
http://www.gcflearnfree.org/windows10/getting-started-with-windows-10/1/
http://www.yamicsoft.com/windows10manager/product.html

Would like to get some feedback on this issue.

EDIT: OS on all PCs is Windows 7 x64 Pro and Ultimate.
Browsers: Firefox v37.0.2 - 50.0.2; Latest Chrome, palemoon and IE8 and 9.
Virus: Malware Bytes v2 and v3
There is no VPN configuration in the router.

 

[Blinkyz]

Im experiencing the same problem since couple of months and its growing.
Even SNB forum is long to load now.All the troubleshotting above was made and more.....
Reset router, clearing cache on all browser, deactivate firewalls,flushing dns cache in Windows,.... etc.Nothing solve. Tested with my Dir-615 and everyting is ok.

 

[Reinvented]

What is your ISP and DNS settings used?

 

[TanyaC]

What is your ISP and DNS settings used?

DNS is OpenDNS: (p) 208.67.222.222, (s) 208.67.220.220; Been using that service since 2010 without issue.

I will not under any circumstances use the Google DNS servers, even to test. I've already tested with my ISP's default DNS server, and problem was the same.

ISP settings: The connection is fiber to the premises (fttp), 100d/40u. Dymanic IP. I believe it's IPoE (Thats what it says when I had my Billion 7800VDOX), but I don't know how to check on the AC87U (The problem only started when I replaced the Billion with the AC87U).

I never ran the router with the factory shipped firmware. I upgraded to Merlin before I commissioned the router, so I don't know if the problem exists with the default firmware. I'm told the ASUS firmware is buggy and only semi stable. Hmm...

 

[TanyaC]

Tested with my Dir-615 and everyting is ok.

Well, I'm glad I' m not the only person.

But if this were an ASUS Router or Merlin problem I'd expect there would be a lot more reported issues, as the router is quite popular, and Merlin is quite stable.

So I'm inclined to think it's a configuration issue on my end. I just can't seem to figure what specifically the problem is.

What is perplexing is that EVERY PC in this house suffers from it, which unfortunately points the finger back towards the router. (Especially considering the PCs are not identical in configuration and run different software (same OS).

This one has me stumped.

Maybe the D-Link;s working is just a coincidence.

 

[RMerlin]

Your problem is most likely caused by your ISP issuing you an IP that is on a malware blacklist, and those sites will block that IP. When you change router, you use a different MAC to request an IP from your ISP, and this IP isn't blacklisted.

Same reason why it works through a VPN: different IP.

Try using your DLink router's MAC on the WAN page (MAC clone field), then reboot the router. Chances are you will find you are suddenly able to reach all those sites.

 

[TanyaC]

Thank you for your reply.

I changed the MAC to that of my DLINK and rebooted.

Same problem.

Powered off router for 5 minutes, power on.. same problem (Though I definitely am getting different IP addresses)

According to http://whatismyipaddress.com/blacklist-check the IP address is blocked by apnews.org, but that's the only one. According to APNews, they don;'t like my DNS records

So I tried http://www.blacklistalert.org/ and it also lists zen.spamhaus.org

Reverted settings to use my ISPs DNS servers. Same issue. And same reason given by apnews.org. (With the routers own MAC address, and with my Dlink's MAC address)

They have listed 175.32.0.0./13. That's over half a million IP addresses. Is this a red herring?

Put everything back the way it was since none of these tests resolved the problem.

 

[Zirescu]

When was the last time you did a factory default reset and did a manual configure of the router?? Are you running 380.64_2?

 

[TanyaC]

Last factory reset was after upgrading to 380.64_2 on December 28th 2016
Problems started in October 2016 (When I purchased router). Since then I'd have easily factory reset it half a dozen times.

 

[Zirescu]

If you specify the OpenDNS settings directly on the PC are you able to connect to the websites?

 

[TanyaC]

If you specify the OpenDNS settings directly on the PC are you able to connect to the websites?

No.

Remove OpenDNS settings from LAN config page & reboot
IPconfig /release & /renew - Verify now using ISP DNS servers.
Update NIC Config to manually specify OpenDNS Servers
ipconfig /release & /renew - Verify now on OpenDNS servers
Attempt to access http://www.staticice.com.au. Website flashes up for a brief second then displays connection reset error.

 

[Zirescu]

Do you have the AI protection enabled? If you want to do a TeamViewer session send me a PM and I can take a look to see if I spot any issues.

 

[TanyaC]

Do you have the AI protection enabled? If you want to do a TeamViewer session send me a PM and I can take a look to see if I spot any issues.

Under Network Protection I am using Infected Device Prevention and Blocking and Vulnerability Protection (Malicious website is turned off for testing this problem).

Under Parental controls I have set up restrictions to adult sites for a few of the PCs.

DNS Filtering is turned off.

I've never used team viewer. I'll have to get one of my sons to show me how to set it up and use it.

However, the router is now being used by several people. Usually the mornings are best for me as the boys are usually not using devices before noon. I'm on GST+11 atm

 

[TanyaC]

Thanks to a generous effort by Zirescu, the problem has been found and fixed.
In my keywords filters I had "google-analytics". Seems many sites use this service. That was the offending entry.
I will find other ways to block it.
Thanks to all who offered assistance.

In my defense, I was sure when I factory reset the router there were no filters. Don't know what I missed... I swear I don't usually suffer from hallucinations