I've moved overseas, with my Mac. It is running 10.9.5

I can open some websites but not others, not even superuser.com - enough websites won't open for me to be sure it is me, not them. Enough do open to know I am connected to the internet. Other computers connecting through the same network can open the problem sites. All browsers and the software update function are having issues, so it isn't just a chrome or safari issue.

The error when a webpage won't open is "page took to long to respond"

How can i fix this?

  • What does your DNS settings look like? – Tuan Anh Hoang-Vu Jun 9 '15 at 17:30
  • If you use a VPN does the behavior change? – Ramhound Jun 9 '15 at 17:30
  • @tuananh - what DNS settings? – Will Jun 9 '15 at 17:35
  • @Ramhound - i don't have a VPN – Will Jun 9 '15 at 17:36
  • @Will - There exists free VPNs. The point of the VPN is to determine if your ISP is filtering the content or if its a simple DNS problem. – Ramhound Jun 9 '15 at 17:37

One rare-but-not-TOO-rare cause of "some sites open but others don't" is an MTU problem, such as a failure of the "Path MTU Discovery" algorithm (a.k.a. a "PMTU Discovery black hole").

As a test, try setting your MTU down to 1300 and see if all websites open. If so, then adjust your MTU higher until you find the maximum value that works.

From what I've seen, Google configures all their servers to use a smaller TCP MSS (Maximum Segment Size, the TCP-layer equivalent to the IP-layer's MTU concept) to make sure their sites load even for people with Path MTU Discovery black holes, so some people describe MTU problems as "Google sites load, but lots of other big-name sites don't".

Path MTU Discovery relies on:

  1. All routers along the path between the client and the server must honor the "Don't Fragment" bit in the IP header, and send back an ICMP "Fragmentation Required, but "Don't Fragment" bit set" error message. I've seen bad routers that don't properly do this, and break PMTU discovery.
  2. All routers/firewalls along the path must allow those ICMP messages to pass. I've seen ignorant firewall administrators block all ICMP because they wanted to block ping. They didn't realize that ping uses just one pair of ICMP message types (echo request/response) and that there are many other ICMP message types that are critical for proper operation of the Internet, that should not be blocked.
  3. Any NAT gateways along the path must properly NAT-translate the ICMP messages so that they get back to the machine that sent the packet that was too big. I've seen bad NAT gateways that mishandle ICMP messages and break PMTU discovery.

I get a lot of U.S. website non-responses accessing them from Argentina. I attribute this to a webmaster's thinking "This is not for your market, so I ain't wasting CPU cycles on you."

So what I do is access through a proxy server.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.