Help me, AskMe, you're my (last) hope. The Actiontec wireless router that Verizon insists is the only thing they can give me to use for our home FIOS service is keeping me from accessing MetaFilter at home.
Obviously, I'm submitting this from work, which I would MUCH rather not do.
Verizon brought in the new router last month to fix a problem we were having with the TV channel guide. It fixed that, and everything else internet-related seemed to be working just fine - we can send and receive email and access the internet, but I couldn't reach any of the MetaFilter sites. I first tried all the standard fixes - deleted my cookies, turned off my firewalls - and got nowhere. I asked the admins by MeMail from work, and they didn't have any further suggestions either. I also spent a few hours on the phone with a couple of Verizon reps, who insisted that the router was working properly and the problem must be with either my computer at home or the website I was trying to reach.
Here's where it gets really weird. I did some poking around on my own in the router menu, and finally found a Security Log that listed a large number of blocked "Outbound Traffic" events. The error message for each was "Blocked - NAT out failed" and the details given were "First packet in connection is not a SYN packet". Most (but not all) of these failed connections were to IP address 18.104.22.168 - which is MetaFilter.
Since I was now way over my head technically, I wrote mr_crash_davis for advice. His response was so helpful (albeit still over my head), I'll quote it in full:
Well, for a TCP/IP handshake to occur, three things have to happen:
The client sends a SYN to the server.
In response, the server responds with SYN-ACK.
The client sends an ACK back to the server.
So, it seems obvious that your attempt to connect to MeFi is dropping its SYN somewher along the line. Since this all happened post-router change, it also seems obvious that it's dropping in the router. Now the question becomes 'Why is the router dropping the SYN portion of the TCP/IP handshake, and only to this one site?'
A bit of Googling turns up a number of sites where people with Verizon FIOS are having this issue, so at least you're not alone. Most of them have narrowed it down to either a NAT port forwarding problem or a problem in the "advanced filtering" section of the router. A suggestion on a few sites is to try an upgrade to the router firmware, here: [link]
I'll do some more poking around and see what else I can find.
Armed with this additional information, I spent several more hours on the phone with several different Verizon reps. They insist the browser is upgraded with the most recent firmware. They tried configuring the router several different ways, and even had me download Firefox just to be sure it wasn't a browser issue. Nothing worked. The next-to-last technician I got had me do a hard reboot of the router with a paperclip - that looked like it was going to work, since when I got back on I was able to call up, briefly, the MetaFilter home page, but when I tried to switch to any other page (including the login page) it hung up again. Checking the Security Log confirms it was the same error - First packet in connection is not a SYN packet.
The last person I spoke with tried everything again, and then called Actiontec for assistance. To my great consternation and dismay, the official word now is "yes, it's something to do with the router, but they don't have a fix for it, and we're not the manufacturer, so we don't support it. However, that's the only router we can provide you to support your FIOS network."
This did not make me happy. I was told I still have the option of bypassing the router and plugging the internet cable directly into the computer if I should ever want to visit that website that's not working, but that really doesn't sound appealing to me. However, since I would much prefer visiting MeFi at home and not the office (I am a self-employed attorney, and was keeping myself logged out at work precisely so I didn't waste too much time here during the day), that may be the only way I'll ever get to participate on MeFi again, at least until we get a new internet provider at home or Actiontec upgrades their routers.
To sum up:
It's not a cookie issue, or a firewall issue.
It's not a browser issue - the same thing happens in IE and Firefox.
Email is working, the internet is working - it appears that some domains are throwing the same error, but all of the .metafilter ones are.
Finally, there is definitely a connection between my computer and MeFi. The Verizon techs had me "ping" the site, and it returned a ping. That led one tech to insist that the problem was that I had been blocked by the website itself (the admins assure me that isn't the case!) The problem is solely in the Actiontec wireless router, which for some unknown reason is failing to complete a back-and-forth connection with MetaFilter (and possibly other sites as well).
So - does anyone else have any suggestions? Ever heard of or had this problem or a similar one before? As I say, you're my only hope.