Peculiar Internet access issues - pulling my hair out...

rajasiman

Hello everyone,

I am having a peculiar issue - some of my queries for web addresses fail - it is not consistent and I ended up going through all of my network devices and resetting the network connection settings yet only my Pixel 9 Pro XL (I will refer to this as my phone going forward) has issues accessing websites.

I run pi-hole with unbound as my Network level ad blocker with a DNS resolver, I see requests from my phone being answered by pi-hole. It is very peculiar when some URLs from the same domain don't resolve. Example: https://old.reddit.com/r/reddevils will open, yet https://old.reddit.com/r/aviation won't. I see requests to both coming through and be answered. news.ycombinator.com opens without any problem.

WhatsApp and other apps are working fine, I can see the requests being logged for those websites too.

I also am unable to access 192.168.x.x addresses - I have had to use a different device to access the pi-hole admin panel. Tried on both vanadium and on firefox, it's the same result.

I have restarted the phone multiple times, also have the latest update installed. Can anyone please help me troubleshoot this? Thank you :D

rajasiman

somehow it all works now... and i didn't change anything. I am absolutely flabbergasted xD

rajasiman

~~somehow it all works now... and i didn't change anything. I am absolutely flabbergasted xD~~

I kinda isolated it to an issue where my phone only gets a IPv6 address and not a local IPv4 address (192.168.x.x). I somehow got IPv4 assigned to my WLAN connection and then everything was working, and now I tried adding another Access Point and the IPv4 didn't get assigned and now the same problem as mentioned above shows up.

So with this added context, any ideas anyone?

rajasiman

some more info, I changed the Privacy setting inside the WLAN settings from "User per connection randomized MAC (default)" to " User per network randomized MAC" and it immediately connected. Could there be some bug here?

Sorry for the multiple posts, I don't have permissions to edit my previous posts. (or at least that is what the error message told me.)

de0u

rajasiman I changed the Privacy setting inside the WLAN settings from "User per connection randomized MAC (default)" to " User per network randomized MAC" and it immediately connected. Could there be some bug here?

This is consistent with a common bug in DHCP servers, especially IPv4, that don't recycle IP addresses when they need to.

n3t_admin

rajasiman some more info

that's not really helping though. It would be good to know what the network looks like.
Such as, which OS/router is being used? What are the subnets/IP ranges?
What firewall rules are set, if any.

rajasiman

n3t_admin

Sorry for the delayed response, I was asleep :D

The router is a Fritzbox 6690, running the latest firmware. There are no VLANs, the subnet is the default one 192.168.178.0/24

There were no specific firewall rules set.

I checked inside the Network connections page and there was my current MAC Address being listed without an IP Address ana that got me scrolling. There were a lot of inactive MAC Addresses in the list of past known devices with IP address allocated, and I deleted a couple of those allocations without any IP and it immediately started working.

So I guess that was the bug?

Thanks for responding :)

n3t_admin

rajasiman not a bug, the FritzBox's ARP table seems to have been filled up. This can happen quickly when your GrapheneOS device is set to "randomize MAC per connection" since it will send a new MAC on every reconnect. I don't know how long the TTL is for MAC addresses on AVM routers, but it seems to be pretty long. So while the router ran out of IPv4 addresses to give you (since ARP table was full), you could only use IPv6 and subsequently every connection using IPv4 would be dropped, while every IPv6 would still work, since you had an IPv6 assigned to your GOS phone. That's the working theory right now. It also might explain why some reddit domains failed, while others worked.

rajasiman

n3t_admin thank you for explaining the problem in detail, I think I can find out how I should get this fixed. :D I also will ensure the MAC address randomization for Home WLAN is not set for every connection. I didn't realize this (Random MAC per Connection) was the default setting and after a LOT of troubleshooting yesterday I randomly changed that setting and it seemed to work.

Thank you everyone for responding and helping me :D have a nice day :D

1qkv9ddu3so2irvz

I had a similar issue. At some random point the Fritz box wouldn't let me connect to the Threema servers anymore. In had to switch to mobile internet to get messages. Other websites were affected as well, but the Threema thing is what I remember well.

I think the problem disappeared when I stopped my Phone to circle through random MAC addresses every time I connected to the home Wlan. But I'm not entirely sure to be honest. The IP4 / IP6 argument makes me wonder if that was actually the case here.

Now I do everything via my mobile network and have absolutely no problems.

Edit: Oh, @n3t_admin supported my discovery with the random MAC addresses. So that really was the culprit 😅

n3t_admin

1qkv9ddu3so2irvz keep in mind that rotating MAC addresses for your home network makes little sense for most threat models. "Per network" is the optimal setting in this case. In theory, you could even turn off randomized MAC off completely for your home network, if you do it only for that network. Your real MAC will be just "another random" one.

The "per connection" option is best suited for random places you visit frequently, like cafes, restaurants, bars, even public transport, libraries and so on.

1qkv9ddu3so2irvz

Very true! The thing is, that was when I started using GOS and just didn't remember about this setting, which is set like this by default (I think). Looking at the logs on the Router I realized this and changed this setting, because as you pointed out, it makes no real sense at home.