Intermittent IPv4 packet drops after enabling hardware NAT on consumer router

Environment

Home lab: consumer dual-core ARM router running vendor firmware v1.2.8 with hardware NAT (acceleration) option enabled; ISP WAN is PPPoE; LAN has multiple devices (Linux server, Raspberry Pi, smart plugs) on single VLAN; MTU on PPPoE set to 1492.

Symptoms

Certain internal clients intermittently fail to reach some IPv4 public services (HTTP and SSH connections hang or reset). Small probes (ICMP ping < 100 bytes) often succeed while larger TCP transfers stall. Issue appears more frequently during high throughput (large file downloads) and affects different destination IPs unpredictably.

Observations

Router logs show few dropped WAN packets near the timeouts but no clear firewall blocks. tcpdump on an affected client shows SYN packets transmitted but no SYN-ACK returned for large MSS sizes; when MSS is manually reduced on the client to 1200 bytes, connections succeed. Disabling IPv6 has no effect. Rebooting the router temporarily restores normal behavior for several hours.

Already attempted

Rebooted router; updated router firmware to v1.2.9 (no change); disabled QoS and UPnP; toggled firewall; ran traceroute and observed final hop responses; changed client's MTU to 1200 as workaround which restored connectivity for that client; enabled port-forwarding tests which behaved similarly.

Question

What are the likely root causes for intermittent IPv4 connectivity that are correlated with enabling hardware NAT, and what reversible diagnostic steps can confirm whether this is an MTU/fragmentation/acceleration bug versus a routing or NAT table exhaustion issue?

Post timeline

COMMUNITY RESPONSES

Verified community troubleshooting

0 replies

No answers yet..

Showing 0 of 0 community responses

AI DIAGNOSTICS

Incident analysis

Updated 1w ago• Trouble ID

Most likely causes

Router hardware NAT (packet offload) mishandles large TCP segments leading to black-holing of packets (PMTU/MSS related). 90%

Firewall or QoS acceleration path bypassing software MSS clamping; some packets need MSS clamping but router hardware doesn't do it correctly. 88%

Fragmentation handling bug in vendor firmware interacting with PPPoE MTU (1492) resulting in lost ICMP 'fragmentation needed' messages. 85%

Summary

Symptoms point to a Path MTU / MSS-related packet loss or an offload/acceleration bug in the router's hardware NAT implementation. The fact that reducing MSS/MTU on the client restores connectivity suggests in-path fragmentation or TCP MSS clamping is failing. The temporary improvement after reboot suggests stateful hardware resource exhaustion (conntrack/NAT table) or a hardware firmware bug that manifests under sustained flows.

Suggested Fixes

Diagnostic step 1

Temporarily disable hardware NAT/acceleration in the router and retest large TCP transfers to see if the problem disappears (reversible setting).

Diagnostic step 2

On an affected client, reproduce failure while running tcpdump on the client and on the router (if supported) to capture MSS/MTU and ICMP 'fragmentation needed' messages; save captures for analysis.

Diagnostic step 3

Enable TCP MSS clamping on the router (or add an MSS clamping rule on a downstream device) so that SYNs advertise a lower MSS (e.g., 1200) and verify if connectivity stabilizes.