Unable to download from download.microsoft.com

RouterOS General
1

Users can browse and download files from all of the internets without any problems. But when they go to microsoft.com and click a download link they get “The connection with the server was reset”.

This happens on all PC’s and mac’s behind the RB450G. I have three separate locations that have this problem. Sometimes resetting the mikrotik will allow downloads to happen, sometimes not.

I have tried changing the MTU, MSS and in a desperate attempt even the TTL but without success.

/ ip firewall mangle
add chain=forward action=change-mss new-mss=1400 tcp-flags=syn protocol=tcp
Tried mss values from 600 to 1420, 1440…)

I also tried changing the MTU on the WAN interface to different values from 1500 to 1300.

Things to note:
These are three different RB450G’s with different versions of routerOS v4.6, v4.16…

These are all basic business networks without qos, pppoe or proxies just using the most basic configs.

Two of the locations are using a Comcast cable connection. They are behind a SMC cable modem/router which is in “passthrough”/bridge mode. The mikrotik has a static WAN ip assigned to it and uses the SMC device as a gateway.

When I remove the mikrotik and plug the PCs directly into the SMC unit they are able to download files from microsoft.

http://www.speedguide.net/routers/smc-smcd3g-biz-docsis-30-commercial-cable-modem-1057

Any ideas why do my mikrotiks dislike downloading files from microsoft so much? :slight_smile:
mikrotik_download_microsoft_com.JPG

2

The first thing that I would suspect would be a DNS problem. See if the router, or hosts can resolve that domain or not with the DNS servers specified in the router, then change the DNS servers and try again if they can’t.

Otherwise post an export of your firewall rules so that they can be reviewed for potential problems.

3

Figured it out. I was missing a rule to drop invalid traffic. Once this was added the downloads started working in all locations.

/ip firewall filter chain=input action=drop in-interface=ether1

Here is what the logs showed:

2011-04-03 23:26:31 Local7.Debug 10.10.10.1 firewall,info Home: input: in:ether1 out:(none), src-mac 00:22:2d:xx:xx:xx, proto TCP (ACK), 65.54.95.xx:80->173.xx.xxx.xxx:22705, len 1500

Looks like download.microsoft.com could not negotiate the mtu without having the drop invalid packets rule in place.

Hope this helps someone else.

4

It helped me - Thank you very much!