I work remotely and have need to access (other than work related web addresses) API endpoints which are run from AWS lambda functions. As of yesterday, certain addresses are unreachable - not 40x response errors, just unreachable, timing out. When I'm connected via a VPN, the addresses work (not necessarily from another country, a UK based connection is fine). Failing web addresses include the CMS's my employer uses which I've had no issue using for the past 4 years.
I've gone the ChatGPT route to help fix and none of the suggestions have, but it has given me a diagnosis of:
Sky’s MTU/routing change breaking fragmented TLS ClientHello packets
I have to redact web and IP addresses but curl logs are provided below, both with and without a VPN connection active to an example API endpoint.
Without VPN connection active
* Host <HOSTNAME>:443 was resolved.
* IPv6: (none)
* IPv4: <IP-1>, <IP-2>, <IP-3>
* Trying <IP-1>:443...
* Connected to <HOSTNAME> (<IP-1>) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* CAfile: /etc/ssl/cert.pem
* CApath: none
<hangs here indefinitely>
With VPN connection active
* Host <HOSTNAME>:443 was resolved.
* IPv6: (none)
* IPv4: <VPN-IP-1>, <VPN-IP-2>, <VPN-IP-3>
* Trying <VPN-IP-1>:443...
* Connected to <HOSTNAME> (<VPN-IP-1>) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* CAfile: /etc/ssl/cert.pem
* CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / <CIPHER> / [blank] / UNDEF
* ALPN: server accepted h2
* Server certificate:
* subject: CN=<HOSTNAME>
* start date: <CERT_START_DATE>
* expire date: <CERT_END_DATE>
* subjectAltName: host "<HOSTNAME>" matched cert's "<HOSTNAME>"
* issuer: <CERT_ISSUER>
* SSL certificate verify ok.
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://<HOSTNAME>/<ENDPOINT_PATH>
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: <HOSTNAME>]
* [HTTP/2] [1] [:path: /<ENDPOINT_PATH>]
* [HTTP/2] [1] [user-agent: curl/8.7.1]
* [HTTP/2] [1] [accept: */*]
> GET /<ENDPOINT_PATH> HTTP/2
> Host: <HOSTNAME>
> User-Agent: curl/8.7.1
> Accept: */*
>
* Request completely sent off
< HTTP/2 200
< date: <DATE>
< content-type: application/json; charset=utf-8
< content-length: <LENGTH>
< x-amzn-requestid: <REQUEST_ID>
< access-control-allow-origin: *
< x-amzn-remapped-content-length: <LENGTH>
< x-amz-apigw-id: <APIGW_ID>
< cache-control: max-age=60
< etag: <ETAG>
< x-powered-by: Express
< x-amzn-trace-id: <TRACE_ID>
My hardware:
Manufacturer: Sky
Model: SR203
Firmware Version: 7.04.0205.R
DSL Firmware Version: A2pvfbH043p1.d26
What I've tried (at the AI's suggestion):
- Lowering MTU on connection to 1480 and rebooting router
- Lowering MTU on connection to 1472 and rebooting router
- Disabling IPV6
- Setting a DNS host other than the router on the local computer
Any help or guidance on this would be appreciated.
