I have a problem with the same symptoms as this post:
- UPC Connect Box in default mode (IPv4 and IPv6)
- Unifi network wired to the Connect Box, my devices use wifi through this, not UPC
- When my problem is happening, all devices see TCP Connection Refused errors (packet returned is ICMP “connection administratively prohibited”)
- It’s not a physical connection problem. Ping and UDP DNS appear to be unaffected.
- The problem mostly (but not completely) correlates with one particular device being connected to the inner Unifi network. When it’s connected directly to the UPC wifi, there’s no problem.
- I have monitoring that tracks this by sending repeated curl requests and monitoring the output.
It’s often around 10-20% of connection requests that fail over a 30 minute window, with spikes up to 40-60%.
My suspicion is that it’s an interaction between some or all of:
- double NAT
- VPN connection from the one device that triggers it
- IPv6 on the UPC that does not support subnetting/prefix delegation through to the internal Unifi network (setting up IPv6 on the Unifi network without prefix delegation had little effect, and may have made the problem worse).
I think my next step is to disable IPv6 on the Connect Box and move to bridge mode, to eliminate as much as possible from the connection path. My understanding is that this means:
- No IPv6 - the Connect Box will get a single public dynamic IPv4 address, and no IPv6 address
- No router - the Connect Box will not run a DHCP server, a DHCPv6 server, or wifi
- Single NAT - my Unifi gateway will NAT to the Connect Box, but there won’t be any NAT between the Connect Box and the carrier network
@Sunrise_Team Is that true? If so, how can I get my Connect Box switched to IPv4-only? Should I also request to move to bridge mode (I want to do that eventually but like having a backup for when my problem happens!)
Thanks