Can't download anything from download.opensuse.org while behind home router's NAT

I have TP-Link WR740N home router with latest firmware, l2tp connection via WAN to internet and everything works fine except download.opensuse.org, off course name resolution works.

Basically i can ping it by hostname or ip and mtr shows good traceroute, but wgetting anything from this domain or trying to zypper install/refresh just hangs with no output, also i cant view repositories via any browser as well.
This is the only site i have issue like this.

I think adding host as DMZ in router’s settings will solve it(sorry, this idea came to me at work, and i didn’t configured external router interface for configuration to test, will do it later), but anyway this isn’t good idea, because i have several opensuse machines at home and its not a solution.

Adding your system to your router as part of a DMZ should only impact
unsolicited requests from the Internet, which is not at all related to
downloads from sites using HTTP (it might be relevant for active FTP
connections, but that’s not what zypper is doing usually). That does not
mean I have an answer for your problem, but exposing your entire system,
when that does not fully solve the problem (you have multiple machines as
you mentioned), seems like the wrong course. Sure, test it if you’d like,
but there is something else going on.

Perhaps get a LAN trace on your workstation. see if you can see packets
coming back and being rejected for some reason.

Please confirm whether or not you can do these downloads using the same
computer(s) from alternate networks (library, work, friend/family, etc.).
You’ve already tested multiple browsers, so ruling those out is probably
safe, so maybe this is some kind of system proxy issue, or an ISP issue,
or a weird router issue. Seems unlikely, but your ability to
ping/traceroute/etc. proves that layer three is working, so next we move
up to layer four (TCP) and try to isolate what is different there. The
layer three bit only applies assuming you’ve tested the actual download
servers used to send the actual files, and those are likely not servers
like download.opensuse.org etc., so it may be worthwhile to test more there.


Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below…

Off course it is just works as expected if i use my work network, for example.

Most interesting is that i just noticed: in my office i use exactly same router but different proto and ISP - l2tp at home and pppoe at office. I think i need to compare firmware versions as well - who knows, may be downgrading to office router firmware will help(i’m sure that it isn’t latest as mine)

This is how debug flag on wget looks like for two hosts at a same time, without timeout flag it just waiting forever:
http://paste.org.ru/?bd5vgb

Unfortunately i cant fetch network dumps directly from router’s interfaces - i use stock firmware, but i will either capture dump from end point device and test dmz for one host in several hours.

PS
Just in case - off course my android phone also unable to show download.opensuse.org, but is able to do so using chrome’s or opera’s data compression mode - it was also expected.

Have you tried setting a smaller MTU. The default is 1500, but L2TP headers can take up some space. I’ve seen suggestions to try 1460 or smaller MTU.

It is by default 1460 and this value is recommended by ISP support.

Adding a host as DMZ is not working as well.

It was OK when i’m using PC as a router. The only difference with current connection is default route to internet - ISP’s dhcp sets default gw to some ip via tunel while on PC-as-a-router i configure it manualy to just tunel without ip(works, but not correct - some routing issues accessing router from outside and speed drop). May be it is important.

After some investigation i found other several sites with this issue: d3.ru, ok.ru, leprosorium.ru. Fortunately i started to experiment with connection settings and it was fixed by setting MTU to 1400 and later i’ve tried 1410 - it was fine too. So it is ISP support failure. Sorry for bother you. Thank you.