1
Diagnostic step 1
Verify MTU end-to-end: from a client, use ping6 with large payloads and 'don't fragment' equivalent (e.g., ping6 -s) to find the largest working packet size; note 'Packet Too Big' responses if any.
FULL AI ANALYSIS
IPv6-only LAN: HTTPS to IPv4-only sites times out while ICMP to synthesized addresses succeeds
Generated Oct 15, 2026, 9:17:34 AM
Analysis summary
Symptoms indicate a translator/path MTU or TCP MSS issue: ICMPv6/ICMP 'fragmentation needed' messages are likely being blocked or not generated on the IPv4 path (PPPoE MTU 1492 vs IPv6 MTU 1500). Large TCP connections stall because packets exceed MTU and the translator or remote IPv4 path cannot notify the IPv6 sender with ICMPv6 'Packet Too Big'. Intermittent success for small responses fits PMTU black hole behavior. Secondary possibilities include stateful NAT64 conntrack exhaustion causing new TCP handshakes to be dropped, or misconfigured DNS64 synthesizing addresses that reach different IPv4 endpoints causing asymmetric routing/filtering.
Possible causes
PMTU black hole due to MTU mismatch (PPPoE or lower-MTU IPv4 path) combined with missing ICMPv6 'Packet Too Big' from IPv4 side to IPv6 sender (no path for signals), causing TCP packets to be dropped
85%Router firewall or ISP blocking ICMP or fragment/MTU messages needed for PMTU discovery between IPv4 and IPv6 domains
50%Stateful NAT64/translator (tayga) running out of conntrack/NAT entries or dropping initial SYN/SYN-ACK packets under load, so TCP handshakes never complete
30%DNS64 synthesizing AAAA addresses that route to IPv4 servers which filter/refuse traffic from the translator's source address (asymmetric filtering) causing established connections to stall
25%Suggested fixes
2
Diagnostic step 2
Temporarily enable TCP MSS clamping to the lowest common MTU (e.g., 1420) on the router/translator to force path-safe segments; test HTTPs transfers for stability.
3
Diagnostic step 3
On the router, capture tcpdump on both IPv6 and IPv4 faces during a failing transaction and check for 'ICMPv4 fragmentation needed' on the IPv4 side and 'Packet Too Big' on IPv6 side. If missing, check ISP/PPPoE device for ICMP filtering.
4
Diagnostic step 4
Monitor NAT64/tayga conntrack table (conntrack -L or /proc/net/nf_conntrack) and increase max if entries hit limit; correlate with failed handshake timestamps.
5
Diagnostic step 5
Test connecting the same client via a dual‑stack WAN (or revert router to dual-stack temporarily) to confirm the issue is specifically NAT64/IPv6-only related — you already observed dual-stack fixes it, which points to translator/PMTU causes rather than client config problems. If MSS clamp fixes the issue, make the change persistent and consider raising with ISP to avoid ICMP filtering upstream and to fix MTU asymmetry permanently.