I'm building a firewall / gateway on a raspberry PI (Debian 9)

I'm using firewalld to create firewall rules.

So far, most sites and services are working fine. However there are a few sites that are not accessible, one example is Netflix. However, Facebook and Google work perfectly over HTTPS.

So I have 3 interfaces configured, lan0, ppp0, and vpn0

lan0 = Local lan interface ppp0 = PPPoE connection to my internet provider vpn0 = Openconnect connection to a work VPN

Starting off with an unconfigured firewall, these are the only commands I used to set things up:

firewall-cmd --zone=external --change-interface=ppp0 firewall-cmd --zone=external --change-interface=vpn0 firewall-cmd --zone=trusted --change-interface=lan0 firewall-cmd --zone=public --add-service=http

I then browse the internet from a local client ( and most sites are working. But I'm having a problem with Netflix and Skype (so far).

Here is what happens when I used curl from the same client, it just hangs forever.

curl -v https://www.netflix.com * Rebuilt URL to: https://www.netflix.com/ * Hostname was NOT found in DNS cache * Trying * Connected to www.netflix.com ( port 443 (#0) * successfully set certificate verify locations: * CAfile: none CApath: /etc/ssl/certs/ * SSLv3, TLS unknown, Certificate Status (22): * SSLv3, TLS handshake, Client hello (1):

The same command from the gateway works (RPI) just fine.

Looks like the client is stuck waiting for a server response? Did I miss something?

  • Does the client have openssl installed and a default set of certs created? – Michael Prokopec Feb 5 at 13:33

After much Googling, it turns out this has nothing to do with my firewall at all.

It was all related to what MTU setting I had on my PPPoE link.

The solution was to set it to 1452.

A full explanation can be seen here

  • Please check that your firewall rules will allow ICMP messages of type fragmentation-needed through. It allows a technique called Path MTU discovery to automatically determine the optimal MTU value for each connection, and is supported by essentially all operating systems since Windows 95. If you're blocking it, you might also have problems accessing some cloud services or systems behind an IPv6 gateway, as those may restrict the MTU value still further. – telcoM Feb 6 at 10:31
  • re @telcoM, firewalld configuration as described should be OK. It allows RELATED packets. (And if I read correctly, all the pre-packaged zones explicitly allow all icmp types for input and forwarding. Maybe I'm reading it wrong). – sourcejedi Feb 19 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.