Manual

Websites stall while loading

Small things work, large things do not. That is not an outage, that is packet size.

You can ping, your mail arrives, most sites open normally. But one site hangs on a white screen, a download stalls after a few hundred kilobytes, and copying a file to the office never finishes. Switch to mobile data and it works.

This is almost always MTU. Small packets fit everywhere, large ones do not, and the packet that does not fit disappears without an error. So you see half a page rather than a failure. It is not DNS (names are being found) and not a firewall blocking something (the connection is being made).

The quick checks, in this order

  1. Measure how large a packet may be. /ping 1.1.1.1 size=1472 do-not-fragment. A good answer: ordinary replies. Nothing back means you lower it to size=1464 and then size=1452. If 1452 works and 1472 does not, you are on a 1492 path, so PPPoE.
  2. What is on the uplink? /interface print detail and find the MTU of your WAN interface or of pppoe-out1. A good answer: 1500 on plain Ethernet, 1492 on PPPoE.
  3. Is the MSS being clamped? /ip firewall mangle print stats. A good answer: a rule with action=change-mss, new-mss=clamp-to-pmtu and the comment clamp MSS on WAN, with a counter that climbs. If the rule is not there, that is your fix.
  4. Is ICMP being dropped? /ip firewall filter print stats. A good answer: no drop rule on ICMP with a climbing counter. Without ICMP no device on the path can find the right packet size.
  5. Do the ports agree with each other? /interface ethernet print detail shows mtu and l2mtu per port. A good answer: the same number everywhere within one network.

The usual causes

  • PPPoE without MSS clamping. The most common one by far. PPPoE takes eight bytes off your packet, and a server that thinks it may send 1500 sends too much. Turn Clamp TCP MSS on in the WAN section.
  • A tunnel in the path. WireGuard, GRE, EoIP and VXLAN all cost room. Same symptom, different place. See MTU and jumbo frames.
  • ICMP blocked outright. Somebody once read "turn off ping" as "drop ICMP". Path MTU discovery runs on ICMP messages, so after that your network guesses forever. In the Firewall section, Block ping from WAN only blocks echo requests, and that is deliberate.
  • Jumbo frames half rolled out. One device on 9000 and the rest on 1500 produces exactly this picture inside your own network: small things work, a file copy hangs.
  • A hand-set MTU on the WAN. Any value below 1500 on the uplink needs the same clamping as PPPoE.

What the configurator does about it

The field Clamp TCP MSS on PPPoE/tunnels appears in the WAN section as soon as your uplink is PPPoE or has an MTU below 1500, and it is on by default. Switch it off while it is needed and the tool warns you in so many words that some websites will hang while loading. Left on, you get one mangle rule in the script, on the forward chain, only on SYN packets heading for WAN.

If you set a PPPoE MTU above 1492 yourself, the tool says that only works when your provider supports RFC 4638, and the script raises the MTU of the port and of any VLAN on it to match. Setting the bridge MTU higher than the port MTU is a warning too: the bridge then hands its ports packets they throw away.

If you work with several devices and drew cables, the tool compares the MTU at both ends of every cable and across each group of devices wired together. That catches half rolled out jumbo frames before you paste. See MTU and jumbo frames for what exactly is compared.

What the tool cannot do is measure what the path to the outside really carries. That depends on your provider and sometimes changes without notice. The do-not-fragment command above is the only real answer.

When it is not your router

  • The provider gives a smaller path than advertised. Some lines do not go past 1492 or 1480, even without PPPoE. Measure it, then enter the measured value as the MTU on the uplink.
  • A modem that still routes. Double NAT does not shrink the path by itself, but a modem running PPPoE in front of you does. See Behind two routers.
  • The far end of your VPN. If only traffic through the tunnel hangs, measure inside the tunnel rather than on the internet.

Further reading: MTU and jumbo frames, WAN and internet and The VPN connects but nothing passes.

Want to try it right away? Open the configurator