Device: QHora-322
Firmware: 2.6.0
Issue: After connecting via OpenVPN (UDP), ICMP ping works,
but all SSL/TLS connections stall at the “TLSv1.3 (OUT), Client Hello” stage.
This behavior did not occur on previous firmware versions which is 2.5.2.
Is this a known issue with 2.6.0 firmware, or is there a workaround?
Hi @yiheng233 ,
This kind of issue usually results from MTU issue. I need your help to do some actions to solve this issue.
First, open your WAN settings and click Advanced Settings toggle to display the details.
Second, adjust the MTU setting based on your ISP suggestion. If you are not sure about it, please fill in 1480 and apply.
Third, reconnect your VPN session and check if SSL/TLS connections work.
[time] IP [VPN IP].443 > [Local IP].39278: Flags [.], seq {}:{}, ack 5204, win 2672, options [nop,nop,TS val {} ecr {}], length 1404
This capture shows that the response packet reached the router, but it was not forwarded to the client. Therefore, the issue may not be related to MTU.
The problem started immediately after upgrading to firmware version 2.6.0, so it might be a bug in this firmware.
Need to clarify your environment.
I assume that your LAN device cannot receive SSL server hello after QuRouter OpenVPN client received it. Is it?
[time] IP [VPN IP].443 > [Local IP].39278: Flags [.], seq {}:{}, ack 5204, win 2672, options [nop,nop,TS val {} ecr {}], length 1404
Does VPN IP mean external VPN Server public IP?
Please kindly provide your LAN subnet settings and VPN client IP. It helps us to clarify the routing behavior.
How can I submit information or just put package capture on both sides
From the wan package capture record, there is no oversized package. I’m using NordVPN and every OpenVPN config can be found on their website without charges
Yes vpn ip is vpn server ip and local ip is router’s ip( I’m using nat 4 for wan port)
With my further experiments I found that http connections are also not working.
Furthermore, WireGuard/ovpn protocol can establish a connection through that problem tunnel on clients under the router
Ping packages can receive echo for up to 1472 size
Sorry for unable to explain this clearly because I am not a professional person