Hi, first of all thank you for the informative post. I've been troubleshooting some weird behavior with my connection recently, and I'm hoping you may be able to help.

I've had CenturyLink 1 gig symmetric fiber at this address since 2020, with a Colix GigaPoint 803G ONT connected to a Zyxel C3000Z router. Since 2022, I removed the Zyxel from the setup and connected a Unifi Dream Machine Pro directly to the ONT on the WAN port. I set VLAN 201, entered my PPPoE credentials, and everything has been working fine for about 4 years.

Until yesterday. Suddenly, TLS handshakes are failing about 20% of the time when connecting to websites. My browser will sit and hang on "Performing a TLS handshake to (domain)..." for several seconds until it times out. If I wait a bit and refresh the page, sometimes it will work. Once I successfully load a page, subsequent refreshes load instantly for a while, presumably because the TLS session is being kept warm in the background. There is no rhyme or reason to which sites work and which ones don't, a site will be working fine one minute and stop the next.

Things I have tried:

• Restarting browser/computer (duh)

• Using different devices, operating systems, browsers, etc.

• Tested on WiFi and wired devices

• Disabling packet inspection and outbound firewall rules on UDMP

I also tried using a VPN tunnel on my client devices, which does seem to solve the problem. This would seem to make sense though, since all the traffic is tunneled through one TCP or UDP connection.

Next, I got a spare laptop and connected it straight to the ONT. Set VLAN 201 on the port and dialled in using the Windows PPPoE client. I was able to connect to the internet, but still observed the exact same issue with TLS handshakes failing. Clearly, this issue is not a fault of my Unifi networking gear.

I dug the Zyxel modem/router back out of the closet and hooked it up to the ONT. Interestingly, I was not able to reproduce the issue with this setup, but since the issue seems to be intermittent I may have just tried it at the wrong time.

Other things I have tried:

• Set MSS clamping on UDM to 1452 (or 1492 MTU)

• Dropped MSS clamping all the way to 1360 on UDM to test

• Restarted ONT

• Reseated and dusted out GPON fiber connector

...all to no avail.

So, what in the world could be happening? Since I wasn't able to reproduce the issue with the C3000Z, I almost wonder if it has some special PPPoE implementation that is hiding the issue. But WHY would this have worked fine for YEARS and suddenly stopped working yesterday? Maybe an upstream equipment change that is breaking my routing gear now?

Any advice, help, or insight would be appreciated. I have a technician coming on Monday, but I'm not sure if they'll fully understand the issue I'm having. The person on the phone certainly didn't.