Hey,
I was having issues with HTTPS pages/sites not loading, but only in a specific subnet of my network. All the other subnets are able to load all pages/traffic fine. The odd thing is that some HTTPS pages load/work perfectly fine, while other sites (ubnt.com, cloudcore.cloudapp.net, msdn.com, etc.) never end up loading correctly. Any suggestions on what may be causing the issue?
Thanks in advance!
This is usually MTU, or packet loss issues. Isolate and test that subnet and its uplink point to the rest of the network.
Yup the usual offender is MTU related. Likely you are blocking path MTU discovery mechanisms like ICMP from being correctly transmitted through your network.
I am having similar issues myself. nothing has changed. started noticing ubnt radios wouldnt update from from the gui when told to check for updates. cant connect to ubnt.com or netflix.com within this certain subnet and im sure theres more. can remote in to windows box on the main private subnet and everything is fine. havent changed any mtu settings on any mikrotiks or ubnt radios.. whipping my butt lol
It’s possible your upstream has a sub 1500 MTU somewhere and it’s possible it only impacts certain paths (sites)
how would one fix that? thx
You’ll need to test and verify path MTU is working appropriately. Depending on your architecture this can be difficult (especially if you have an IPSec policy based VPN).
A quick test is to reduce your LAN or client MTU to something very small. A good value to start with is 1280 because it remains IPv6 compliant. In theory IPv4 MTU can go very low. If the test sites work with a client manually operating at a lower MTU then that’s your problem. You can bump the client up to normal MTU and start troubleshooting path MTU. In IPv6 this is easier I feel because the client is responsible for fragmentation so they should always receive an ICMPv6 Too Big message from a hop that has a smaller MTU. This can be picked up with Wireshark. The worst case is a device simply has the wrong MTU configured and is silently dropping packets. In that case you have to deliberately send tests through the path until you identify the device by comparing “Too Big” messages to something like traceroute.
Another alternative to MTU is broken IPv6. A lot of big name sites are dual stack. It’s possible your or a middle routers IPv6 is broken and the clients are trying to use IPv6 for valid sites like www.google.com. If you run IPv6 I’d verify it’s functional.
man i appreciate your thoughts, ive done some testing on mtu between the troubled subnet and a known working subnet and if i go lower than 1480 or 1500 just about everything times out. not using any ipv6 on my network but when i torch the interface trying to load netflix i do see ipv6 address appear but no packets travel. it almost seems like its a virus, one segment of my network started showing exact same issues a couple weeks ago. im 100% ubnt wireless devices and all mikrotik for routing. so ubnt devices being infected or just flaky seems to be the norm but mikrotik i can always count on. all wireless devices have latest firmware and have even rolled back to earlier versions. network is routed and each location has private and public subnets . clients are on pppoe from router at each location with a mix of public and private ip allocation. myself i remain private ip addressed for management. i will troubleshoot more but wanted to thank you.
No problem. I forgot to mention HTTPS will settle DF bit. That’s why we generally correlate HTTPS issues to MTU related trouble.
Are your PPPoE interfaces set to 1492 MTU or does your provider accommodate a higher MTU in their backbone? Also, do you have any firewall rules that drop all kinds of ICMP in input of both the PPPoE or Ethernet WAN interface?
yes pppoe are set at 1492. i did more digging and noticed on a working router the mtu settings were 1500/1598 on backhaul interface and all others were 1500/1588 and pppoe virtual interface was 1492. changed the two other problem locations to same and what do ya know, “it works like a hank now” guess at some point i was tired and trying to resolve pppoe clients dropping and changed the mtu settings not knowing wth i was doing. though i hadnt changed any settings in weeks it still bothers me that it all the sudden stopped the issue just started. oh well 
happy holidays and thx for your patience
Good to hear! Same to you!