Just moved to 2 Degrees, and several websites simply don't work, such as Netflix

Forums › 2degrees (including Slingshot, Orcon, Flip, Stuff Fibre, MyRepublic, 2talk and Vocus) › Just moved to 2 Degrees, and several websites simply don't work, such as Netflix

LightBulbnz

17 posts

Geek

#254407 10-Aug-2019 21:58

I've just moved to 2 Degrees today, have a business broadband connection, 900/400 with a /30 IP subnet.

I've noticed that some websites simply don't work - Netflix.com won't load at all - ping resolves fine, tracert below. I notice that Stuff, facebook, trademe etc are fine, but vodafone and skinny's websites don't load either.

Anyone know what could be going on? I've tried various DNS settings - using 1.1.1.1, 8.8.8.8, 2 degrees' servers, same results. Flushed caches etc.

>tracert netflix.com

Tracing route to netflix.com [54.201.91.38]
over a maximum of 30 hops:

1 * * * Request timed out.
2 2 ms 1 ms 1 ms 69.7.69.111.static.snap.net.nz [111.69.7.69]
3 * * * Request timed out.
4 137 ms 137 ms 137 ms two-degrees-new-zealand.as23655.any2ix.coresite.com [206.72.211.83]
5 138 ms 142 ms 138 ms any2ix.coresite.com [206.72.211.146]
6 * * * Request timed out.
7 * * * Request timed out.
8 161 ms 162 ms 165 ms 52.93.14.148
9 161 ms 161 ms 161 ms 52.93.14.141
10 162 ms 163 ms 163 ms 52.93.14.140
11 161 ms 162 ms 162 ms 52.93.14.173
12 161 ms 161 ms 162 ms 52.93.240.81
13 * * * Request timed out.
14 * * * Request timed out.
15 * * * Request timed out.
16 * * * Request timed out.
17 * * * Request timed out.
18 * * * Request timed out.
19 * * * Request timed out.
20 * * * Request timed out.
21 * * * Request timed out.
22 * * * Request timed out.
23 * * * Request timed out.
24 * * * Request timed out.
25 * * * Request timed out.
26 * * * Request timed out.
27 * * * Request timed out.
28 * * * Request timed out.
29 * * * Request timed out.
30 ^C

fe31nz

1232 posts

Uber Geek

#2293829 10-Aug-2019 22:58

Are you using a 2D provided FritzBox? If so, then you should be getting IPv6 connections to Netflix. Does your network have problems with IPv6?

Does Facebook also have problems? That is usually the first site people complain about when their IPv6 is not working properly. The usual problem is that 2D uses a PPPoE connection and unless you are using one of their FritzBoxes configured by them, you have to make sure to set up the PPPoE to use MTU 1500, instead of 1492. The VLAN 10 and Ethernet port also need to be set to MTU 1508 to allow for the 8 bytes of PPPoE overhead. The fibre itself is overprovisioned to allow this to work. Without it, any packets in the 1493-1500 size range get dropped invisibly as they hit the PPPoE connection from either side. That is a violation of the IPv6 standards - when IPv6 packets get dropped, an ICMPv6 overlong packet reply is required to be generated. If those ICMPv6 packets were sent, your IPv6 connections would see the smaller MTU and adjust for it. But all the PPPoE software I have ever met is broken this way, so the ICMPv6 packets never get sent. Large IPv4 packets will just get fragmented automatically into two smaller packets so you do not see any problems with IPv4 connections, except that if you measure them very carefully you find they are slightly slower than expected due to the fragmentation. But automatic fragmentation of IPv6 packets is not allowed.

nslookup netflix.com
Server: savaidhg.6.jsw.gen.nz
Address: 2406:e001:1:2802::2

Non-authoritative answer:
Name: netflix.com
Addresses: 2620:108:700f::3425:4d70
2620:108:700f::3420:be97
2620:108:700f::23a4:93cf
2620:108:700f::3425:db06
2620:108:700f::23a0:b494
2620:108:700f::3425:457c
2620:108:700f::23a4:4198
2620:108:700f::341a:6f2b
52.41.193.16
52.42.228.237
54.69.16.110
54.69.239.253
54.149.101.155
54.201.91.38
54.213.182.74
52.41.20.47

tracert netflix.com

Tracing route to netflix.com [2620:108:700f::3425:457c]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms erl.6.jsw.gen.nz [2406:e001:1:2801::251]
2 1 ms 1 ms 1 ms 2406:e000:2801:17::1
3 * * * Request timed out.
4 36 ms 36 ms 36 ms 23655.syd.equinix.com [2001:de8:6::2:3655:1]
5 167 ms 174 ms 174 ms 6939.syd.equinix.com [2001:de8:6::6939:1]
6 172 ms 174 ms 174 ms 10ge3-5.core1.sjc1.he.net [2001:470:0:311::1]
7 163 ms 164 ms 171 ms 10ge7-2.core1.sjc2.he.net [2001:470:0:55::2]
8 164 ms 165 ms 164 ms 2001:470:0:34f::2
9 164 ms 164 ms 164 ms 2001:428::205:171:3:199
10 164 ms 164 ms 164 ms 2001:428:7000:10:0:16:0:2
11 * * * Request timed out.
12 163 ms 172 ms 164 ms 2620:107:3000::d
13 * * * Request timed out.
14 * * * Request timed out.
15 * * * Request timed out.
16 181 ms 181 ms 181 ms 2620:107:4000:3::12
17 * * * Request timed out.
18 181 ms 181 ms 181 ms 2620:107:4000:3::19
19 181 ms 188 ms 181 ms 2620:107:4000:3::27
20 * * * Request timed out.
21 * * * Request timed out.
22 * * * Request timed out.
23 * * * Request timed out.
24 * * * Request timed out.
25 181 ms 181 ms 181 ms 2620:108:700f::3425:457c

Trace complete.

tracert -4 netflix.com

Tracing route to netflix.com [54.201.91.38]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms erl.jsw.gen.nz [10.0.1.251]
2 1 ms 8 ms 1 ms 104.7.69.111.static.snap.net.nz [111.69.7.104]
3 * * * Request timed out.
4 137 ms 137 ms 137 ms two-degrees-new-zealand.as23655.any2ix.coresite.com [206.72.211.83]
5 138 ms 137 ms 138 ms any2ix.coresite.com [206.72.211.146]
6 * * * Request timed out.
7 * * * Request timed out.
8 162 ms 162 ms 161 ms 52.93.14.44
9 160 ms 160 ms 161 ms 52.93.14.39
10 161 ms 162 ms 162 ms 52.93.14.254
11 161 ms 161 ms 161 ms 52.93.15.25
12 162 ms 161 ms 162 ms 52.93.240.73
13 * * * Request timed out.
14 * * * Request timed out.
15 * * * Request timed out.
16 * * * Request timed out.
17 * * * Request timed out.
18 * * * Request timed out.
19 * * * Request timed out.
20 * * * Request timed out.
21 * * * Request timed out.
22 * * * Request timed out.
23 * * * Request timed out.
24 * * * Request timed out.
25 * * * Request timed out.
26 * * * Request timed out.
27 * * * Request timed out.
28 * * * Request timed out.
29 * * * Request timed out.
30 * * * Request timed out.

My IPv4 traceroute to Netflix is similar to yours, so it looks like either the Netflix routers are not replying to traceroute packets, or their load balancing is sending the packets to a different IP address. So I do not think there is anything actually wrong there.

LightBulbnz

17 posts

Geek

#2293833 10-Aug-2019 23:29

fe31nz:

Are you using a 2D provided FritzBox? If so, then you should be getting IPv6 connections to Netflix. Does your network have problems with IPv6?

Does Facebook also have problems? That is usually the first site people complain about when their IPv6 is not working properly. The usual problem is that 2D uses a PPPoE connection and unless you are using one of their FritzBoxes configured by them, you have to make sure to set up the PPPoE to use MTU 1500, instead of 1492. The VLAN 10 and Ethernet port also need to be set to MTU 1508 to allow for the 8 bytes of PPPoE overhead. The fibre itself is overprovisioned to allow this to work. Without it, any packets in the 1493-1500 size range get dropped invisibly as they hit the PPPoE connection from either side. That is a violation of the IPv6 standards - when IPv6 packets get dropped, an ICMPv6 overlong packet reply is required to be generated. If those ICMPv6 packets were sent, your IPv6 connections would see the smaller MTU and adjust for it. But all the PPPoE software I have ever met is broken this way, so the ICMPv6 packets never get sent. Large IPv4 packets will just get fragmented automatically into two smaller packets so you do not see any problems with IPv4 connections, except that if you measure them very carefully you find they are slightly slower than expected due to the fragmentation. But automatic fragmentation of IPv6 packets is not allowed.

Changed the MTU, problem fixed.

I'm not using the FritzBox; I'm using an Ubiquiti EdgeRouter Lite.

Thanks heaps for your input.

michaelmurfy

meow
13263 posts

Uber Geek

Moderator

ID Verified

Trusted

Lifetime subscriber

#2293887 11-Aug-2019 09:46

With the Edgerouter on 2degrees:

Turn off TCP MSS Clamping.
Set the MTU to 1508 on the main Ethernet interface going to your ONT, 1500 on the PPPoE interface and 1500 on every other interface.

Also, how did you go with getting the IP Subnet working on the Edgerouter?

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

LightBulbnz

17 posts

Geek

#2294146 11-Aug-2019 14:00

michaelmurfy:

Also, how did you go with getting the IP Subnet working on the Edgerouter?

Massive faff.

Standard IP is inherited by DHCP on interface PPPoE
Additional static IP range is added on interface eth0.10, which PPPoE is the child of
Add SNAT and DNAT rules for each IP to do whatever you want.
Add appropriate firewall rules

cyril7

9058 posts

Uber Geek

ID Verified

Trusted

Subscriber

#2294163 11-Aug-2019 14:28

Hi, really you had to at NAT rules? you should have just added the /30 network to an interface on the router and firewalls to suit and thats all, well thats all I have ever done on a variety of routers (Cisco 2910's, Fortigates, Mikrotiks).

Cyril