Local machine causing connectivity problems to IPv4 websites

Question

I set up a local machine participating in a blockchain p2p network using Ubuntu Server 20.04. The computer is connected to my (low-end) home router via Ethernet cable (and/or Wi-Fi).

If the machine is turned on, I can't visit IPv4 websites (such as amazon.com) from other devices in my local network whereas IPv6 websites (such as google.com) work fine. In my browser, I get an ERR_CONNECTION_REFUSED error. Strangely, pinging external IPv4 addresses from these devices works even if I cannot access the associated website. The node itself maintains a connection and syncs with the p2p network but sometimes it is disconnected and I cannot find peers.

Disabling the p2p client on the machine solves the problem immediately and I can access IPv4 websites from other devices again.

What I've tried so far:

I called my ISP. According to them, it is not a problem on their end.
I changed the DNS server on my devices to 8.8.8.8 from Google. This didn't help.
I used a VPN, which worked and let me access IPv4 websites.

UPDATE:

This is how my netplan config looks like /etc/netplan/01-netcfg.yaml

network:
  version: 2
  ethernets:
    enp1s0:
      dhcp4: true
  wifis:
    wlp2s0:
      optional: true
      dhcp4: true
      access-points:
        "MyNetworkSSID":
          password: "MySecretPassword"

With netstat -a, I checked the number of established connections of my p2p node to be between 60 and 70.

UPDATE 2

The number of UDP connections seems to be very large which could be the issue (as user Bob pointed out). I made some screenshots of iptraf-ngs detailed interface statistics for comparison:

Statistics after 1 minute shortly after starting the p2p network (period of maximal load)

Statistics after 1 minute of idling

UPDATE 3:

idling (only ssh is active)

>>> sudo tcpdump
205 packets captured
235 packets received by filter
0 packets dropped by kernel

Rare case: p2p node is running and ip4v works

>>> sudo tcpdump
85268 packets captured
99647 packets received by filter
14346 packets dropped by kernel

p2p node is running and ip4v connectivity is broken

>>> sudo tcpdump
224 packets captured
11449 packets received by filter
11194 packets dropped by kernel

Here an excerpt of the output generated by tcpdump:

23:28:46.092812 IP6 2a02:908:2:a::1.domain > ethnode.37187: 12082 1/0/1 PTR vps-a6e5820a.vps.ovh.net. (91)
23:28:46.092868 IP6 ethnode > 2a02:908:2:a::1: ICMP6, destination unreachable, unreachable port, ethnode udp port 37187, length 147
23:28:46.474444 IP6 ethnode.57942 > 2a02:908:2:a::1.domain: 47223+ [1au] PTR? 111.32.183.52.in-addr.arpa. (55)
23:28:46.474634 IP6 ethnode.60418 > 2a02:908:2:a::1.domain: 58846+ [1au] PTR? 111.32.183.52.in-addr.arpa. (55)
23:28:52.026797 IP ec2-54-93-37-91.eu-central-1.compute.amazonaws.com.9100 > ethnode.42548: Flags [.], ack 86092, win 1450, options [nop,nop,TS val 882586355 ecr 806259356], length 0
23:28:52.026843 IP ec2-54-93-37-91.eu-central-1.compute.amazonaws.com.9100 > ethnode.42548: Flags [P.], seq 20649:20690, ack 86092, win 1450, options [nop,nop,TS val 882586355 ecr 806259356], length 41
23:28:52.442256 IP ip-81-210-176-198.hsi17.unitymediagroup.de > ethnode: ICMP host pool-100-8-209-196.nwrknj.fios.verizon.net unreachable - admin prohibited filter, length 68
23:28:52.442498 IP ip-81-210-176-198.hsi17.unitymediagroup.de > ethnode: ICMP host vmi281255.contaboserver.net unreachable - admin prohibited filter, length 68
23:28:52.442727 IP ip-81-210-176-198.hsi17.unitymediagroup.de > ethnode: ICMP host p4ff866e6.dip0.t-ipconnect.de unreachable - admin prohibited filter, length 68
23:28:52.442845 IP ethnode.57058 > ec2-18-132-143-154.eu-west-2.compute.amazonaws.com.30313: Flags [S], seq 892243886, win 64240, options [mss 1460,sackOK,TS val 1978287574 ecr 0,nop,wscale 7], length 0
23:28:52.442856 IP ethnode.57026 > 46.101.173.99.30300: Flags [S], seq 2368761152, win 64240, options [mss 1460,sackOK,TS val 1536371124 ecr 0,nop,wscale 7], length 0
23:28:52.442871 IP ec2-52-37-3-144.us-west-2.compute.amazonaws.com.9000 > ethnode.37412: Flags [.], ack 3322671408, win 844, options [nop,nop,TS val 909942956 ecr 665035467], length 0
23:28:52.442969 IP ip-81-210-176-198.hsi17.unitymediagroup.de > ethnode: ICMP host d54C075AB.access.telenet.be unreachable - admin prohibited filter, length 68
23:28:52.443144 IP ethnode.55632 > 134.209.177.40.30305: Flags [S], seq 1646301929, win 64240, options [mss 1460,sackOK,TS val 1054555862 ecr 0,nop,wscale 7], length 0
23:28:52.443268 IP ip-81-210-176-198.hsi17.unitymediagroup.de > ethnode: ICMP host vrn78-1-82-232-34-210.fbx.proxad.net unreachable - admin prohibited filter, length 68
23:28:52.443497 IP ip-81-210-176-198.hsi17.unitymediagroup.de > ethnode: ICMP host 247.155.231.35.bc.googleusercontent.com unreachable - admin prohibited filter, length 68
23:28:52.443718 IP ip-81-210-176-198.hsi17.unitymediagroup.de > ethnode: ICMP host 226.65.86.34.bc.googleusercontent.com unreachable - admin prohibited filter, length 68
23:28:52.443943 IP ip-81-210-176-198.hsi17.unitymediagroup.de > ethnode: ICMP host ip175.ip-193-70-72.eu unreachable - admin prohibited filter, length 68
23:28:52.444057 IP6 ethnode.47483 > 2a02:908:2:a::1.domain: 42799+ [1au] PTR? 36.102.138.144.in-addr.arpa. (56)
23:28:52.444255 IP ethnode.41741 > compalhub.home.domain: 10839+ [1au] PTR? 36.102.138.144.in-addr.arpa. (56)
23:28:52.444318 IP ip-81-210-176-198.hsi17.unitymediagroup.de > ethnode: ICMP host pool-98-110-221-150.bstnma.ftas.verizon.net unreachable - admin prohibited filter, length 68
23:28:52.449265 IP ec2-52-37-3-144.us-west-2.compute.amazonaws.com.9000 > ethnode.37412: Flags [.], ack 1199, win 844, options [nop,nop,TS val 909942962 ecr 665035467], length 0
23:28:52.453208 IP mail.seamonkey.tech.13423 > ethnode.59334: Flags [P.], seq 656391773:656391794, ack 219687401, win 501, options [nop,nop,TS val 1564452635 ecr 1173219098], length 21
23:28:52.453249 IP ethnode.59334 > mail.seamonkey.tech.13423: Flags [.], ack 21, win 501, options [nop,nop,TS val 1173219336 ecr 1564452635], length 0
23:28:52.453279 IP ip-81-210-176-198.hsi17.unitymediagroup.de > ethnode: ICMP host sd-69419.infobzh.eu unreachable - admin prohibited filter, length 68
23:28:52.453482 IP ec2-52-37-3-144.us-west-2.compute.amazonaws.com.9000 > ethnode.37412: Flags [.], ack 1805, win 844, options [nop,nop,TS val 909942966 ecr 665035468], length 0
23:28:52.455277 IP ip-81-210-176-198.hsi17.unitymediagroup.de > ethnode: ICMP host 65.102.241.187 unreachable - admin prohibited filter, length 68
23:28:52.455332 IP ip-81-210-176-198.hsi17.unitymediagroup.de > ethnode: ICMP host 161.35.74.193 unreachable - admin prohibited filter, length 68
23:28:52.896004 IP6 ethnode.42196 > 2a02:908:2:a::1.domain: 21924+ [1au] PTR? 198.176.210.81.in-addr.arpa. (56)
23:28:52.896144 IP ethnode.54508 > compalhub.home.domain: 3665+ [1au] PTR? 198.176.210.81.in-addr.arpa. (56)
23:28:52.898626 IP compalhub.home.domain > ethnode.41741: 10839 1/0/1 PTR cpe-144-138-102-36.static.belong.com.au. (109)
23:28:52.898657 IP ethnode > compalhub.home: ICMP ethnode udp port 41741 unreachable, length 145
23:28:52.900120 IP ec2-52-37-3-144.us-west-2.compute.amazonaws.com.9000 > ethnode.37412: Flags [.], ack 4221, win 844, options [nop,nop,TS val 909943412 ecr 665036035], length 0
23:28:52.920171 IP ec2-54-93-83-30.eu-central-1.compute.amazonaws.com.9100 > ethnode.56882: Flags [P.], seq 1880445172:1880445872, ack 2682991055, win 0, options [nop,nop,TS val 1986717043 ecr 828470466], length 700
23:28:52.920209 IP ethnode.56882 > ec2-54-93-83-30.eu-central-1.compute.amazonaws.com.9100: Flags [.], ack 700, win 2571, options [nop,nop,TS val 828470759 ecr 1986717043], length 0
23:28:52.920238 IP6 2a02:908:2:a::1.domain > ethnode.42196: 21924 1/0/1 PTR ip-81-210-176-198.hsi17.unitymediagroup.de. (112)
23:28:52.921586 IP6 ethnode.58127 > 2a02:908:2:a::1.domain: 19071+ [1au] PTR? 196.209.8.100.in-addr.arpa. (55)
23:28:52.921734 IP ethnode.56434 > compalhub.home.domain: 48469+ [1au] PTR? 196.209.8.100.in-addr.arpa. (55)
23:28:53.108023 IP6 ethnode.48467 > 2a02:908:2:a::1.domain: 10728+ [1au] PTR? 231.125.86.167.in-addr.arpa. (56)

The following message seems significant to me:

23:28:52.453279 IP ip-81-210-176-198.hsi17.unitymediagroup.de > ethnode: ICMP host sd-69419.infobzh.eu unreachable - admin prohibited filter, length 68

PROBLEM RESOLVED:

Buying a better cable modem solved the problems for me.

score 2 · Accepted Answer · answered Aug 04 '20 at 22:18

This is a somewhat common problem with p2p networks and NAT (used on IPv4).

Due to IPv4 address exhaustion, we cannot assign a globally unique IPv4 address to every host on a network. NAT is used to work around this issue by mapping multiple addresses from a non-unique private range (RFC1918) to a single public IP address.

In other words, it maps every unique privateip:port pair to a unique publicip:port pair. Some NAT setups take this a step further by adding the remote address (and port) to the unique tuple.

The problem here is your router needs to track all of these connections. Doing so takes memory, and in the common case of hardware offload, this memory can be a fixed (and rather small) size. I've seen routers that can't maintain more than 1024 simultaneous connections.

With p2p, as traditionally seen in Bittorrent etc., the sheer number of connections can overflow even a moderately-sized NAT table, leading to either dropped connections or the inability to open new connections. You can still ping, since ping uses ICMP, which does not use ports in this way - ICMP NAT uses query IDs rather than ports as TCP or UDP do (see also, How does a NAT server forward ping ICMP echo reply packets to users?).

There's another problem these days: many ISPs are deploying CGNAT, where multiple customers share a single public (globally unique) IP address. This can further reduce the number of IPv4 connections you can make; some are set as low as 500.

You can possibly upgrade or reconfigure your router to track more connections. But if the problem also exists at the ISP/CGNAT level, that doesn't help much.

Instead, the best solution is to look into limiting how many connections your p2p software can make. If the software provides a configuration option, use that. Otherwise, you might look into applying restrictions at the OS level; in Linux this can be done with iptables and connlimit.

Local machine causing connectivity problems to IPv4 websites

1 Answers1