Forum Discussion

steve-o's avatar
steve-o
Tuning in
2 days ago

Hub 4 TLS handshakes - ~5s delay

Hub 4, firmware 01.04.092.07.16.EURO.PC20, in router mode.  TLS handshakes are stalling for ~5s when the firewall is enabled - problem clears when firewall disabled.  Have pinhole reset the hub multiple times.  SamKnows RealSpeed is reporting expected speeds, and the power levels / error counters look fine in the hub stats.  

Is there a newer firmware available for this hub that fixes the issue, or should I be requesting a new Hub 5?  I'm on Gig1 HFC if that matters.

5 Replies

  • legacy1's avatar
    legacy1
    Alessandro Volta
    2 days ago

    This is likely VM deep packet inspection for getting SNI from client hello problem likely does not happen in modem mode

    • steve-o's avatar
      steve-o
      Tuning in
      2 days ago

      Thanks.  Agree that's a potential cause.  Whilst I have another firewall (Opnsense) behind the hub, I'd rather not expose that directly to the Internet so prefer keeping routed mode on the hub.

      I'd prefer the supplied equipment worked as expected.  Do you know if a newer firmware or a Hub 5 would resolve?  Curious to know why the hub would be inspecting traffic anyway.

      • Client62's avatar
        Client62
        Alessandro Volta
        2 days ago

        Another firewall, does that mean you have double NAT ?

  • steve-o's avatar
    steve-o
    Tuning in
    10 hours ago

    Yes, the config was double NATted.  Not my preference, but I'd left the hub in routed mode for a few reasons:

    1. The realspeed test is occasionally useful; doesn't work in modem mode
    2. The DHCP server on the Hub is extremely flaky in modem mode.  It might also be in routed mode, but I'd just hard coded the IP anyway
    3. I hadn't spent the time to fine tune my Opnsense configuration and be confident in it yet

    More testing today - turning the firewall off on the hub doesn't always prevent the TLS establishment delay.  So, I bit the bullet, fixed (3) today and put the Hub into modem mode.  Time will tell how stable the DHCP is.  Thanks for the advice both.