<div dir="ltr"><div>Jeff,</div><div><br></div><div>Since you are using bridge mode, try adjusting down the MTU supported through the network. We have observed that a realistic MTU for Verizon 5G home internet is about 1428 bytes.</div><div><br></div><div>Good luck,</div><div><br></div><div>Tom</div><div><br></div><div><br></div><div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Mar 19, 2023 at 8:00 AM <<a href="mailto:nanog-request@nanog.org">nanog-request@nanog.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Send NANOG mailing list submissions to<br>
<a href="mailto:nanog@nanog.org" target="_blank">nanog@nanog.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://mailman.nanog.org/mailman/listinfo/nanog" rel="noreferrer" target="_blank">https://mailman.nanog.org/mailman/listinfo/nanog</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:nanog-request@nanog.org" target="_blank">nanog-request@nanog.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:nanog-owner@nanog.org" target="_blank">nanog-owner@nanog.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of NANOG digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Spamhaus flags any IP announced by our ASN as a criminal<br>
network (Brandon Zhi)<br>
2. Verizon/Qwest single end-user difficulty vs Xfinity (Jeff Woolsey)<br>
3. Re: Spamhaus flags any IP announced by our ASN as a criminal<br>
network (Tom Beecher)<br>
4. Re: Verizon/Qwest single end-user difficulty vs Xfinity<br>
(Darin Steffl)<br>
5. Re: Verizon/Qwest single end-user difficulty vs Xfinity (Joe)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Sat, 18 Mar 2023 14:57:12 +0100<br>
From: Brandon Zhi <<a href="mailto:Brandon@huize.asia" target="_blank">Brandon@huize.asia</a>><br>
To: <a href="mailto:nanog@nanog.org" target="_blank">nanog@nanog.org</a><br>
Subject: Spamhaus flags any IP announced by our ASN as a criminal<br>
network<br>
Message-ID:<br>
<<a href="mailto:CAAyZddEAu48oYngA6xgwrsijbVf9LiwLHVE5OnO3y%2B8faUSMLg@mail.gmail.com" target="_blank">CAAyZddEAu48oYngA6xgwrsijbVf9LiwLHVE5OnO3y+8faUSMLg@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Hello guy,<br>
<br>
We recently discovered that any IP address announced by our ASN is<br>
blacklisted by Spamhaus, even if we only announced it but not use it.<br>
<br>
I would like to ask if this is manually set by Spamhaus or is the system<br>
misjudgment? Has anyone encountered the same situation as us?<br>
<br>
<br>
Best,<br>
<br>
*Brandon Zhi*<br>
HUIZE LTD<br>
<br>
<a href="http://www.huize.asia" rel="noreferrer" target="_blank">www.huize.asia</a> <<a href="https://huize.asia/" rel="noreferrer" target="_blank">https://huize.asia/</a>>| <a href="http://www.ixp.su" rel="noreferrer" target="_blank">www.ixp.su</a> | Twitter<br>
<br>
<br>
This e-mail and any attachments or any reproduction of this e-mail in<br>
whatever manner are confidential and for the use of the addressee(s) only.<br>
HUIZE LTD can?t take any liability and guarantee of the text of the email<br>
message and virus.<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://mailman.nanog.org/pipermail/nanog/attachments/20230318/3e9aa32f/attachment-0001.html" rel="noreferrer" target="_blank">http://mailman.nanog.org/pipermail/nanog/attachments/20230318/3e9aa32f/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Fri, 17 Mar 2023 18:32:53 -0700<br>
From: Jeff Woolsey <<a href="mailto:jlw@jlw.com" target="_blank">jlw@jlw.com</a>><br>
To: <a href="mailto:nanog@nanog.org" target="_blank">nanog@nanog.org</a><br>
Subject: Verizon/Qwest single end-user difficulty vs Xfinity<br>
Message-ID: <<a href="mailto:8c539894-c5ee-e01c-08a1-5a72c0037c04@jlw.com" target="_blank">8c539894-c5ee-e01c-08a1-5a72c0037c04@jlw.com</a>><br>
Content-Type: text/plain; charset=UTF-8; format=flowed<br>
<br>
Verizon 5G Internet Support is not at a high-enough pay grade to assess <br>
this problem...? So I'm turning to y'all.<br>
<br>
I'm trying to save $$$ and increase speed, using Verizon 5G Home <br>
Internet to replace XFinity, even though they gave me a faster modem a <br>
few weeks ago.? I run both of the modems in Bridge/Passthrough mode.<br>
<br>
A friend of mine is nice enough to offer some offsite backup space, and <br>
I use rsync over ssh to get there.? He's 1500 miles away.? He uses a <br>
non-standard ssh port (keeps the doorknob twisters away).?? This sort of <br>
thing has been working without difficulty over Xfinity (my end) for <br>
years.? He also changed his connection almost a month ago now, to Qwest, <br>
I believe.<br>
<br>
I try the same thing over Verizon [1] and ssh always times out, no <br>
response.? We are also NTP peers, and that doesn't work well over <br>
Verizon either. ICMP traceroutes and pings succeed.? UDP traceroutes do <br>
not get any further than 207.109.3.78 (last hop before destination) .? <br>
Not every traceroute offers TCP, but MacOS does, and nothing responds to <br>
any of that, even at the usual ssh port.? UDP traceroutes to either port <br>
behave like an ordinary one, which it is.<br>
<br>
Since I can get there via xfinity, I can traceroute, ping, but not ssh <br>
back through Verizon.<br>
<br>
I also set up an incoming (xfinity) port from the same non-standard ssh <br>
port forwarding to regular ssh on a different system on my LAN, and when <br>
I ssh -p <port>? that from Verizon (even cellphone data),? I get that <br>
other system, and that works fine.? The 207... router is not in that path.<br>
<br>
I can also ping the Verizon connection from Xfinity (and vice versa).<br>
<br>
Go figure.<br>
<br>
[1] This same difficulty occurs in Verizon's Looking Glass, from several <br>
different places, and other Looking Glasses (e.g. Cogent, Equinix).? It <br>
also occurs on my Verizon phone data connection (not WiFi).? If he were <br>
serving more stuff out of his home, this would be a bigger problem.<br>
<br>
<br>
-- <br>
Jeff Woolsey {woolsey,jlw}@{jlw,jxh}.com first.last@{gmail,jlw}.com<br>
Spum bad keming.<br>
Nature abhors a straight antenna, a clean lens, and empty storage.<br>
"Delete! Delete! OK!" -Dr. Bronner on disk space management<br>
"Card sorting, Joel." -me, re Solitaire<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Sat, 18 Mar 2023 16:25:50 -0400<br>
From: Tom Beecher <<a href="mailto:beecher@beecher.cc" target="_blank">beecher@beecher.cc</a>><br>
To: Brandon Zhi <<a href="mailto:Brandon@huize.asia" target="_blank">Brandon@huize.asia</a>><br>
Cc: <a href="mailto:nanog@nanog.org" target="_blank">nanog@nanog.org</a><br>
Subject: Re: Spamhaus flags any IP announced by our ASN as a criminal<br>
network<br>
Message-ID:<br>
<CAL9Qcx7rF6ssPwO48vAs-ULxv-40=<a href="mailto:kWyYOA63vZ0YFGVB100iQ@mail.gmail.com" target="_blank">kWyYOA63vZ0YFGVB100iQ@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Given the list of things on these two prefixes alone, I would venture to<br>
guess it's not a misjudgement.<br>
<br>
<a href="https://check.spamhaus.org/listed/?searchterm=5.178.2.1" rel="noreferrer" target="_blank">https://check.spamhaus.org/listed/?searchterm=5.178.2.1</a><br>
<a href="https://check.spamhaus.org/listed/?searchterm=80.66.64.1" rel="noreferrer" target="_blank">https://check.spamhaus.org/listed/?searchterm=80.66.64.1</a><br>
<br>
<br>
<br>
On Sat, Mar 18, 2023 at 3:47?PM Brandon Zhi <<a href="mailto:Brandon@huize.asia" target="_blank">Brandon@huize.asia</a>> wrote:<br>
<br>
> Hello guy,<br>
><br>
> We recently discovered that any IP address announced by our ASN is<br>
> blacklisted by Spamhaus, even if we only announced it but not use it.<br>
><br>
> I would like to ask if this is manually set by Spamhaus or is the system<br>
> misjudgment? Has anyone encountered the same situation as us?<br>
><br>
><br>
> Best,<br>
><br>
> *Brandon Zhi*<br>
> HUIZE LTD<br>
><br>
> <a href="http://www.huize.asia" rel="noreferrer" target="_blank">www.huize.asia</a> <<a href="https://huize.asia/" rel="noreferrer" target="_blank">https://huize.asia/</a>>| <a href="http://www.ixp.su" rel="noreferrer" target="_blank">www.ixp.su</a> | Twitter<br>
><br>
><br>
> This e-mail and any attachments or any reproduction of this e-mail in<br>
> whatever manner are confidential and for the use of the addressee(s) only.<br>
> HUIZE LTD can?t take any liability and guarantee of the text of the email<br>
> message and virus.<br>
><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://mailman.nanog.org/pipermail/nanog/attachments/20230318/6ea2cdce/attachment-0001.html" rel="noreferrer" target="_blank">http://mailman.nanog.org/pipermail/nanog/attachments/20230318/6ea2cdce/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Sat, 18 Mar 2023 16:06:52 -0500<br>
From: Darin Steffl <<a href="mailto:darin.steffl@mnwifi.com" target="_blank">darin.steffl@mnwifi.com</a>><br>
To: Jeff Woolsey <<a href="mailto:jlw@jlw.com" target="_blank">jlw@jlw.com</a>><br>
Cc: "North American Network Operators' Group" <<a href="mailto:nanog@nanog.org" target="_blank">nanog@nanog.org</a>><br>
Subject: Re: Verizon/Qwest single end-user difficulty vs Xfinity<br>
Message-ID:<br>
<CAH-uaeq+yibTAkDNwUew6eh_D4toBSmqFy=oR=<a href="mailto:K%2B6%2BG-Ri9ceg@mail.gmail.com" target="_blank">K+6+G-Ri9ceg@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Verizon does weird stuff with traffic in their cell network. Like wireguard<br>
only running 1-2 Mbps over Verizon but faster on fixed like providers. I'm<br>
assuming they rate limit certain protocols to avoid bypassing their<br>
streaming video rate limits. I can see 200/30 Mbps on a 4G speedtest but<br>
VPN runs very slow still.<br>
<br>
Xfinity is better than cellular so I'd switch back. Any fixed cable, fiber,<br>
wisp, or fast dsl provider should be better and more stable.<br>
<br>
On Sat, Mar 18, 2023, 2:51 PM Jeff Woolsey <<a href="mailto:jlw@jlw.com" target="_blank">jlw@jlw.com</a>> wrote:<br>
<br>
> Verizon 5G Internet Support is not at a high-enough pay grade to assess<br>
> this problem... So I'm turning to y'all.<br>
><br>
> I'm trying to save $$$ and increase speed, using Verizon 5G Home<br>
> Internet to replace XFinity, even though they gave me a faster modem a<br>
> few weeks ago. I run both of the modems in Bridge/Passthrough mode.<br>
><br>
> A friend of mine is nice enough to offer some offsite backup space, and<br>
> I use rsync over ssh to get there. He's 1500 miles away. He uses a<br>
> non-standard ssh port (keeps the doorknob twisters away). This sort of<br>
> thing has been working without difficulty over Xfinity (my end) for<br>
> years. He also changed his connection almost a month ago now, to Qwest,<br>
> I believe.<br>
><br>
> I try the same thing over Verizon [1] and ssh always times out, no<br>
> response. We are also NTP peers, and that doesn't work well over<br>
> Verizon either. ICMP traceroutes and pings succeed. UDP traceroutes do<br>
> not get any further than 207.109.3.78 (last hop before destination) .<br>
> Not every traceroute offers TCP, but MacOS does, and nothing responds to<br>
> any of that, even at the usual ssh port. UDP traceroutes to either port<br>
> behave like an ordinary one, which it is.<br>
><br>
> Since I can get there via xfinity, I can traceroute, ping, but not ssh<br>
> back through Verizon.<br>
><br>
> I also set up an incoming (xfinity) port from the same non-standard ssh<br>
> port forwarding to regular ssh on a different system on my LAN, and when<br>
> I ssh -p <port> that from Verizon (even cellphone data), I get that<br>
> other system, and that works fine. The 207... router is not in that path.<br>
><br>
> I can also ping the Verizon connection from Xfinity (and vice versa).<br>
><br>
> Go figure.<br>
><br>
> [1] This same difficulty occurs in Verizon's Looking Glass, from several<br>
> different places, and other Looking Glasses (e.g. Cogent, Equinix). It<br>
> also occurs on my Verizon phone data connection (not WiFi). If he were<br>
> serving more stuff out of his home, this would be a bigger problem.<br>
><br>
><br>
> --<br>
> Jeff Woolsey {woolsey,jlw}@{jlw,jxh}.com first.last@{gmail,jlw}.com<br>
> Spum bad keming.<br>
> Nature abhors a straight antenna, a clean lens, and empty storage.<br>
> "Delete! Delete! OK!" -Dr. Bronner on disk space management<br>
> "Card sorting, Joel." -me, re Solitaire<br>
><br>
><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://mailman.nanog.org/pipermail/nanog/attachments/20230318/50b770ae/attachment-0001.html" rel="noreferrer" target="_blank">http://mailman.nanog.org/pipermail/nanog/attachments/20230318/50b770ae/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 5<br>
Date: Sat, 18 Mar 2023 16:53:21 -0500<br>
From: Joe <<a href="mailto:jbfixurpc@gmail.com" target="_blank">jbfixurpc@gmail.com</a>><br>
To: Jeff Woolsey <<a href="mailto:jlw@jlw.com" target="_blank">jlw@jlw.com</a>><br>
Cc: <a href="mailto:nanog@nanog.org" target="_blank">nanog@nanog.org</a><br>
Subject: Re: Verizon/Qwest single end-user difficulty vs Xfinity<br>
Message-ID:<br>
<<a href="mailto:CA%2Bzb_vGH28N%2B__GjM65oky6_DC6WWmGuiP2rw5H79R9k6uw4rw@mail.gmail.com" target="_blank">CA+zb_vGH28N+__GjM65oky6_DC6WWmGuiP2rw5H79R9k6uw4rw@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
You mentioned using a non-standard port for your ssh/rsync, have you tried<br>
changing that to something other than what your using?<br>
Keep in mind some of these providers might be blocking non-standard ports<br>
as this is a common method to abuse others and might be a cheaper<br>
alternative to dealing with the constant pile of abuse complaints.<br>
<br>
Maybe not just a thought.<br>
<br>
-Joe<br>
<br>
<br>
On Sat, Mar 18, 2023 at 2:51?PM Jeff Woolsey <<a href="mailto:jlw@jlw.com" target="_blank">jlw@jlw.com</a>> wrote:<br>
<br>
> Verizon 5G Internet Support is not at a high-enough pay grade to assess<br>
> this problem... So I'm turning to y'all.<br>
><br>
> I'm trying to save $$$ and increase speed, using Verizon 5G Home<br>
> Internet to replace XFinity, even though they gave me a faster modem a<br>
> few weeks ago. I run both of the modems in Bridge/Passthrough mode.<br>
><br>
> A friend of mine is nice enough to offer some offsite backup space, and<br>
> I use rsync over ssh to get there. He's 1500 miles away. He uses a<br>
> non-standard ssh port (keeps the doorknob twisters away). This sort of<br>
> thing has been working without difficulty over Xfinity (my end) for<br>
> years. He also changed his connection almost a month ago now, to Qwest,<br>
> I believe.<br>
><br>
> I try the same thing over Verizon [1] and ssh always times out, no<br>
> response. We are also NTP peers, and that doesn't work well over<br>
> Verizon either. ICMP traceroutes and pings succeed. UDP traceroutes do<br>
> not get any further than 207.109.3.78 (last hop before destination) .<br>
> Not every traceroute offers TCP, but MacOS does, and nothing responds to<br>
> any of that, even at the usual ssh port. UDP traceroutes to either port<br>
> behave like an ordinary one, which it is.<br>
><br>
> Since I can get there via xfinity, I can traceroute, ping, but not ssh<br>
> back through Verizon.<br>
><br>
> I also set up an incoming (xfinity) port from the same non-standard ssh<br>
> port forwarding to regular ssh on a different system on my LAN, and when<br>
> I ssh -p <port> that from Verizon (even cellphone data), I get that<br>
> other system, and that works fine. The 207... router is not in that path.<br>
><br>
> I can also ping the Verizon connection from Xfinity (and vice versa).<br>
><br>
> Go figure.<br>
><br>
> [1] This same difficulty occurs in Verizon's Looking Glass, from several<br>
> different places, and other Looking Glasses (e.g. Cogent, Equinix). It<br>
> also occurs on my Verizon phone data connection (not WiFi). If he were<br>
> serving more stuff out of his home, this would be a bigger problem.<br>
><br>
><br>
> --<br>
> Jeff Woolsey {woolsey,jlw}@{jlw,jxh}.com first.last@{gmail,jlw}.com<br>
> Spum bad keming.<br>
> Nature abhors a straight antenna, a clean lens, and empty storage.<br>
> "Delete! Delete! OK!" -Dr. Bronner on disk space management<br>
> "Card sorting, Joel." -me, re Solitaire<br>
><br>
><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://mailman.nanog.org/pipermail/nanog/attachments/20230318/56fadc80/attachment-0001.html" rel="noreferrer" target="_blank">http://mailman.nanog.org/pipermail/nanog/attachments/20230318/56fadc80/attachment-0001.html</a>><br>
<br>
End of NANOG Digest, Vol 182, Issue 14<br>
**************************************<br>
</blockquote></div></div>