4

If I visit, for instance, http://tutor.com in any browser on my computer, I get a network timeout. But if I visit https://tutor.com it loads. This problem occurs with all devices on the network (Windows, Android, iOS, MacOS), for both wired and wireless connections, and is not specific to that site.

I don't see how the protocol prefix would even matter for DNS resolution, and nslookup works just fine. But then why does the HTTP request time out? The normal behavior would be:

  1. tutor.com resolves to IP address
  2. http request returns a 301 redirect to https
  3. https request succeeds

Here is what happens using PowerShell:

Invoke-WebRequest http://tutor.com/
Invoke-WebRequest: Unable to read data from the transport connection: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond..

Invoke-WebRequest https://tutor.com/

StatusCode        : 200
StatusDescription : OK
Content           : <!DOCTYPE html>
...

I know this works on other networks (my daughter took her computer to a relative's house and it works fine there -- redirecting and loading https://tutor.com).

In a browser, I can work around the problem by prefixing with https instead, but the problem is that the tutor.com application is requesting http URLs, which don't work on my network. What could be causing this behavior, and how can I troubleshoot?

My O/S is Windows 10 20H2 19042.985. I have an ASUS RT-AC66U primary router and a tp-link AX6000 configured as an access point. I am using these OpenDNS IPs https://www.opendns.com/setupguide/#familyshield for DNS servers (I also tried configuring the router to connect to DNS server automatically but it made no difference).

19
  • Does the relative's house use the same ISP as you? Does it work if you use a VPN?
    – harrymc
    Jun 2, 2021 at 14:26
  • The relative does have the same ISP. I am going to try a VPN next.
    – Kyle A
    Jun 2, 2021 at 17:47
  • 1
    Network timeouts in browsers are often not DNS related. DNS timeout is traditionally 2 seconds. how long does it take to timeout when you try it? if its 2 Minutes, then that is an HTTP timeout, not a DNS related issue. Jun 2, 2021 at 17:47
  • 1
    Yes, it is port 80 that must be blocked. Not DNS.
    – Kyle A
    Jun 2, 2021 at 17:49
  • 1
    Which router have you replaced ? Primary or access point ?
    – harrymc
    Apr 25, 2023 at 8:11

3 Answers 3

1
  1. When did this problem start? Do you know what was changed when issue started?

  2. Process of elimination can help troubleshoot many things. You are trying a variation of that by making a change, testing, confirming that change did not fix, rinse repeat. I'd like you to try a more basic version: disconnect everything you can to bare bone essentials then add equipment/changes one by one. This is literal guidance from PC manufacturers to find culprit hardware. In your situation I'd disconnect every router you can & plug directly into your internet providers equipment to see if you can access many HTTP pages. If you can you know the problem isn't there so add a router or configuration one by one, test, rinse repeat.

  3. Based on you OpenDNS & linking to Family Shield I have to assume you are trying to do website-blocking/content-filtering. While trying to block bad stuff on the internet I suspect you made another change that indirectly caused this issue. Since you nor us can seem to figure out the exact setting it's probably good to start from the ground up slowly & methodically

  4. You mention you replaced a router, but didn't specify which one (as you noted you use two)? @harrymc asked this in comments

  5. 1NN in question comments asked you to factory reset router which I think is a good idea, but you never seemed to respond to that.

  6. You CAN dive deeper into the rabbit hole, which in my eyes just prolongs your issue because it only gets more complex. However hey you're learning :)

    a) install nmap popular port scanner. Try to port scan 80 (HTTP) on a website, TBH I am not sure this will help you understand your network as its goal is just to see if the port is open on the remote server which it should be if it's hosting a website

    b) Get Wireshark installed & capture network traffic. It's very verbose as you are literally seeing the network packets/frames happening so lots of white noise & you need to understand how networking works very intimately

15
  • 1
    So based on that router model & your original question that appears to be the Wi-Fi Access Point router. That wouldn't help you if the issue is happening on LAN/wired connecting to main router (Asus). Googling the error you get on PS cmdlet invoke-webrequest everyone usually indicates its a firewall issue or a web server misconfiguration, the later being unlikely since its many websites. If I were in your situation & you insist on not removing all routers except the ISP's your best bet is capturing wireshark info. Could also do a tracert to see what hops/routers to a domain
    – gregg
    Apr 29, 2023 at 16:32
  • 1
    ASUS RT-AC66U manual indicates Advanced Settings has a System Log which might shed some light. pg75 speaks about the network services filter. pg73 indicates you can turn off the firewall which I would briefly do to see if its the culprit. pg32 General, Parental Control. Pg28 QoS could briefly disable as pg30 mentions it can drop lower priority packets. Manual doesn't talk about it, but router product page mentions 'AiProtection Powered by Trend Micro' & app control; maybe something there?
    – gregg
    Apr 29, 2023 at 17:07
  • 1
    asus.com/content/aiprotection asus.com/us/networking-iot-servers/wifi-routers/… Also kind request to upvote any answers or comments that you deem helpful even if they don't necessarily solve your issue, they are helping you, & narrowing it down
    – gregg
    Apr 29, 2023 at 17:07
  • 1
    Tracert indicates two NAT's: AKA your Asus router is doing translation & your ISP (quest) modem. This is not usually a problem, but could be. If you plug PC directly into ISP/qwest modem can you reproduce your issue?
    – gregg
    Apr 30, 2023 at 4:04
  • 1
    208.67.222.123 is OpenDNS Family Shield. Please temporarily change it to another DNS sever that doesn't do parentel/website blocking like googles 8.8.8.8 or 1.1.1.1
    – gregg
    Apr 30, 2023 at 4:09
3

While dns can cause timeouts, this timeout has nothing to do with DNS.

The issue is that http and https are on different ports, and apparently the http port is firewalled from you. If nothing was listening on the remote port, you would get a connection refused instead.

Possibilities here include but are not limited to:

  • Your local host is firewalling http for some reason
  • Your upstream router is firewalling http
  • Something upstream from your router (your isp?) is firewalling http
  • The remote host has firewalled http and may or may not be listening on that port. (But if you can connect to it from other locations, this isn't the case.)
  • The upstream host is running DoS prevention software (like fail2ban) and you have managed to trigger it
  • The host is currently undergoing a DoS attack and is unable to respond in a timely way
  • The remote host is down (but then https would also not work)
  • The remote host is actually a pool of hosts (in the cloud) and the one randomly assigned to service your http request is temporarily down; subsequent attempts might work (or just further trigger the DoS prevention listed above)
17
  • How would I diagnose that? I disabled the firewall in the ASUS router (which I have a wired connection to), but it still doesn't work.
    – Kyle A
    Jun 2, 2021 at 12:47
  • It may not be the router firewalling the connection. It could be the local host or something upstream from the router. It could also be the target host firealling it, but if it works from other locations, this is unlikely unless you've triggered a DoS throttle on the remote host.
    – user10489
    Jun 2, 2021 at 12:58
  • I checked my router and DSL modem, and neither are configured to block port 80. I tried disabling the firewall in both and it didn't help. It has to be something with my network, but I am stumped.
    – Kyle A
    Jun 2, 2021 at 13:25
  • It's not the remote host. It never works, and other sites have the same issue. And when I am connected to my work VPN, it also works.
    – Kyle A
    Jun 2, 2021 at 13:32
  • It may be a firewall on your local host. Malware might also interfere with DNS, and https might be using DNS over https and bypassing that.
    – user10489
    Jun 2, 2021 at 13:38
2
+25

I would look at three possibilities. Your router or DSL modem...

  1. is blocking inbound HTTP traffic
  2. is blocking unsecure 301 redirects (http)
  3. has an outbound rule blocking or misrouting your HTTP request

You can rule out Options 1 & 3, by attempting to visit a purely http site (no redirect), such as http://captive.apple.com/ <-- You should get a plain white page that says, "Success". If this page fails to load, you would need to find the offending rule/setting on your modem or router.

You can test #2 by visiting, http://neverssl.com. This is another http-only page, but it includes a 301 redirect to "[random_server_name].neverssl.com/online/". Same solution as above, if this fails.

Finally to narrow down whether the router or DSL modem(or ISP) is the cause, you should be able connect the DSL modem directly to a computer and try the same tests.

If you're able to narrow down the failure to the DSL modem, but can't find the offending setting/rule, call your ISP and confirm they don't have any kind of filtering or proprietary "security enhancements" enabled on your connection and ask for tech support or replacement on the modem.

5
  • I got white page with Success hitting captive.apple.com I got redirected to shiningquietbrightyawn.neverssl.com/online hitting neverssl.com
    – Kyle A
    Apr 24, 2023 at 19:59
  • Based on your comment not all HTTP pages are failing so this is seemingly a change. Is tutor.com or other HTTP sites still failing? Have you tried to reproduce your issue while directly connecting to your ISP's equipment?
    – gregg
    Apr 27, 2023 at 14:11
  • I am getting "Unable to read data from the transport connection: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond." from any http endpoint. Despite what was said above, captive.apple.com is redirecting to https.
    – Kyle A
    Apr 27, 2023 at 23:37
  • 1
    captive.apple.com isn't redirecting to https here. Using firefox on OS X, developer tools in firefox indicates only http get requests. So SOMETHING is hijacking your web request: DNS, firewall, proxy, parental SW, etc. tracert captive.apple.com (well traceroute for linux/apple) here shows my router, unknown hop 2, then my ISP's eqp/hostname/router & I use a similar setup: netgear in access point mode connect to LAN port of main router
    – gregg
    Apr 29, 2023 at 16:38
  • tracert captive.apple.com Tracing route to captive.g.aaplimg.com [17.253.23.206] over a maximum of 30 hops: 1 1 ms 1 ms 1 ms router.asus.com [192.168.1.1] 2 1 ms 1 ms 1 ms modem.Home [192.168.0.1] 3 6 ms 5 ms 5 ms hlrn-dsl-gw05.hlrn.qwest.net [207.225.112.5] 4 5 ms 6 ms 11 ms 63-225-124-33.hlrn.qwest.net [63.225.124.33] 5 * * * Request timed out. 6 12 ms 6 ms 6 ms 4.14.113.110 7 6 ms 6 ms 6 ms usden5-vip-bx-006.aaplimg.com [17.253.23.206]
    – Kyle A
    Apr 29, 2023 at 19:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .