Sync works but only over VPN

DoctorG

@andylarge What shows a traceroute?
Open Windows Terminal
Type command and hit Return
tracert bifrost.vivaldi.com

andylarge

@DoctorG said in Sync works but only over VPN:

tracert bifrost.vivaldi.com

1 4 ms 4 ms 4 ms VIGOR [192.168.1.1]
2 12 ms 7 ms 12 ms host-80-47-224-1.as13285.net [80.47.224.1]
3 8 ms 10 ms 11 ms ae51-ner002.irl.as13285.net [78.144.1.7]
4 14 ms 15 ms 16 ms ae51-scr101.loh.as13285.net [78.144.1.6]
5 24 ms 15 ms 17 ms siminn-linx-gw-1.isholf.is [195.66.225.26]
6 78 ms 59 ms 57 ms 157.157.69.221
7 57 ms 55 ms 56 ms 206-99-22-46.business.hringdu.is [46.22.99.206]
8 57 ms 55 ms 57 ms 31.209.137.10

DoctorG

@andylarge All nice.

andylarge

@DoctorG This suggestion about the router is interesting. I have not much looked at that. Please give me some time and I will investigate.

DoctorG

@andylarge I have much time, no hurry.
See you later here.

andylarge

@DoctorG Thanks for your help so far. I don't think it is a problem of flipping between 2.4Ghz and 5ghz. I have the setup fixed to 2.4ghz only. But I am starting to ponder whether there is something in the firewall setup of the router I am using that is causing the issue.

Router : Draytek 2862.

The puzzle is that there are no other internet issues on this router. Internet connection is blazing fast over FTTP. Downtime is practically zero. No content filtering set up on the router.

Any further ideas?

Pathduck

@andylarge Could be related to these:
https://forum.vivaldi.net/post/787594
https://forum.vivaldi.net/post/782378

Another router that does not handle TLS13/Kyber maybe?
Might need a router firmware upgrade.

andylarge

@Pathduck Thanks for those posts. Seems like this is the same kind of issue TBH.

Router is on latest firmware and that is quite a recent version after a Draytek security hole was found.

I tried forcing TLS12 but that has not helped. Running out of ideas. Such a strange situation : After switching to TLS12, the Sync works on the first sync. But then begins to fail on 2nd sync. Upload works, but download does not. And then for third sync both directions fail. Pattern is often repeated. But by switching in Proton VPN, voila the sync works.

Pathduck

@andylarge The posts mention a flag related to TLS13/Kyber, did you try that?

andylarge

@Pathduck Yep. Done that. No impact. Any other ideas? You have already been incredibly helpful... Thanks so much.

Pathduck

@andylarge Did you restart the browser after Disabling the flag? With the VPN disabled?

There's a Python script linked from https://tldr.fail:
https://forum.vivaldi.net/post/782469

You can use curl with TLS13 and Kyber/X25519 to see if it gets through.
https://forum.vivaldi.net/post/782478

Note that you need to use vivaldi.com as the Sync server bifrost.vivaldi.com does not support TLS13 anyway. But if your router is failing the connection these test should show it.

You could install Wireshark and do a capture or use tshark and then click "Trigger Updates" from chrome://sync-internals

λ tshark -i4 dst host bifrost.vivaldi.com
Capturing on 'Intel(R) Ethernet Connection (2) I218-V'
    1   0.000000 192.168.0.10 52936 31.209.137.10 443 TCP 54 52936 → 443 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
    2   0.000491 192.168.0.10 52939 31.209.137.10 443 TCP 66 52939 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
    3   0.057004 192.168.0.10 52939 31.209.137.10 443 TCP 54 52939 → 443 [ACK] Seq=1 Ack=1 Win=262144 Len=0
    4   0.058466 192.168.0.10 52939 31.209.137.10 443 TLSv1.2 571 Client Hello (SNI=bifrost.vivaldi.com)
    5   0.117178 192.168.0.10 52939 31.209.137.10 443 TCP 54 52939 → 443 [ACK] Seq=518 Ack=3004 Win=262144 Len=0
    6   0.120012 192.168.0.10 52939 31.209.137.10 443 TLSv1.2 180 Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message
    7   0.182634 192.168.0.10 52939 31.209.137.10 443 TLSv1.2 1472
    8   0.182634 192.168.0.10 52939 31.209.137.10 443 TLSv1.2 632 Application Data
    9   0.183445 192.168.0.10 52939 31.209.137.10 443 TLSv1.2 412 Application Data
   10   0.281410 192.168.0.10 52939 31.209.137.10 443 TCP 54 52939 → 443 [ACK] Seq=2998 Ack=3747 Win=261376 Len=0
10 packets captured

andylarge

I did restart browser and connected with no VPN, flag disabled. No improvement,

Sadly the Python and Curl stuff is just out of my depth!!

I am tempted to have a go with wireshark but I have used it before and found the output to be HUGE and hard to navigate/troubleshoot.

Pathduck

@andylarge said in Sync works but only over VPN:

Sadly the Python and Curl stuff is just out of my depth!!

It's not that difficult really, you've already ran one command-line troubleshooting tool before

Python needs to be installed first of course, so that's a job...
Curl is easy to install: https://curl.se/windows/

Wireshark/Tshark does give a lot of data, but you need to specify exactly what you're looking for.

For Tshark you need to specify a capture filter like host bifrost.vivaldi.com - which will only show packets to/from the Sync server.

For the Wireshark UI you need to specify a display filter like
ip.host == bifrost.vivaldi.com
To only see those packets.

Yes, this is really advanced troubleshooting, but unfortunately I think there's no simple "click here to solve" solution to this problem. And BT is a big ISP, so we'd have more people saying Sync didn't work.

The single thing topics about Sync not working seems to have in common is that they are using some kind of VPN - or are behind a corporate network (or they are in China). And that again leads me to think people are not fully understanding their network setup, and using a VPN is per def advanced networking...

DoctorG

@andylarge Firmware of router up-to-date? → https://fw.draytek.com.tw/Vigor2862/Firmware/v3.9.9.8/

swainasish1

I have a similar issue. My institute has blocked bifrost.vivaldi.com. To solve this problem, I added the Browsec extension. In its smart settings, I created a rule to route bifrost.vivaldi.com through the VPN. This way, my sync works perfectly without having to run the VPN for the entire browser.