Can no longer access ProtonMail after switching to Zen?

Hi All,

I moved to a new ISP, Zen Internet, from Virgin Media yesterday and ever since I can no longer access any Proton services, including Mail and Calendar. This applies to all devices on my network.

Attempting to navigate to https://mail.proton.me in a web browser just times out eventually. Screenshot of Chrome (all browsers are the same). The same applies to all Proton owned domains, such as https://protonmail.com.

DNS (1.1.1.1) appears to be working fine:

$ host mail.proton.me
mail.proton.me has address 185.70.42.37
mail.proton.me mail is handled by 20 mailsec.protonmail.ch.
mail.proton.me mail is handled by 10 mail.protonmail.ch.

Traceroute:

$ traceroute mail.proton.me
traceroute to mail.proton.me (185.70.42.37), 64 hops max, 52 byte packets
1 172.16.1.1 (172.16.1.1) 0.765 ms 0.524 ms 0.386 ms
2 lo0-0.bng2.ixn-lon.zen.net.uk (51.148.77.129) 6.772 ms 11.199 ms 10.711 ms
3 lag-4.p1.ixn-lon.zen.net.uk (51.148.73.89) 4.451 ms 3.906 ms
lag-5.p2.ixn-lon.zen.net.uk (51.148.73.91) 4.471 ms
4 lag-2.br1.ixn-lon.zen.net.uk (51.148.73.195) 4.190 ms
lag-1.br1.ixn-lon.zen.net.uk (51.148.73.181) 3.798 ms 4.238 ms
5 lag51.fr5.lcy1.llnw.net (87.248.216.236) 4.619 ms 4.273 ms 4.591 ms
6 siteprotect.security.neustar (68.142.82.33) 4.403 ms 5.213 ms 4.744 ms
7 * * *
8 gre01.lcy.siteprotect.security.neustar (156.154.218.0) 4.626 ms 3.599 ms 4.609 ms
9 156.154.165.61 (156.154.165.61) 21.334 ms 22.204 ms
156.154.253.101 (156.154.253.101) 22.669 ms
10 * * *
11 185-70-42-37.protonmail.ch (185.70.42.37) 22.440 ms 22.325 ms 21.090 ms

curl fails:

$ curl -I https://mail.proton.me:443
curl: (35) error:02FFF036:system library:func(4095):Connection reset by peer

If I switch to alternate routing on the iOS app, use 4G or connect using a VPN, the problem goes away.

No other websites have this issue.

Anyone else on Zen who can share some insight? They are a well regarded ISP and I can't believe they would block Proton, so I'm wondering if the issue lies elsewhere.

Thanks in advance!

curl works fine for me.

My traceroute:
traceroute to mail.proton.me (185.70.42.37), 30 hops max, 60 byte packets
1 _gateway (192.168.1.1) 0.428 ms 0.438 ms 0.469 ms
2 lo0-0.bng1.ixn-lon.zen.net.uk (51.148.77.128) 13.941 ms 14.061 ms 14.102 ms
3 * * lag-4.p2.ixn-lon.zen.net.uk (51.148.73.87) 9.471 ms
4 lag-1.br1.ixn-lon.zen.net.uk (51.148.73.181) 9.453 ms lag-2.br1.ixn-lon.zen.net.uk (51.148.73.195) 9.381 ms lag-1.br1.ixn-lon.zen.net.uk (51.148.73.181) 9.463 ms
5 lag51.fr5.lcy1.llnw.net (87.248.216.236) 9.241 ms 9.223 ms 9.354 ms
6 siteprotect.security.neustar (68.142.82.33) 27.082 ms 20.609 ms siteprotect.security.neustar (68.142.82.35) 20.317 ms
7 * * *
8 gre01.lcy.siteprotect.security.neustar (156.154.218.0) 8.244 ms 8.316 ms 8.345 ms
9 156.154.165.61 (156.154.165.61) 28.730 ms 28.818 ms 156.154.253.101 (156.154.253.101) 26.197 ms
10 * * *
11 185-70-42-37.protonmail.ch (185.70.42.37) 27.338 ms 27.146 ms 26.727 ms

Interesting. Thanks for checking.

I've raised tickets with Zen and Proton to investigate, they may end up pointing fingers at each other, but we'll see what happens.

To your knowledge, do Zen do any content filtering?

Are you using a router supplied and configured by Zen, or your own?

If the latter, check your MTU and MSS clamping settings as they may be different between VM and Zen.

With PPPoE your max MTU will be 1492, MSS Clamping 1452 (for IPv4) (unless using baby jumbo frames with the PPPoE ethernet interface MTU set to 1508).

Edited by Adrianuk (Wed 28-Sep-22 13:34:37)

clmfsh@magpie:~$ dig mail.proton.me

; <<>> DiG 9.16.33-Debian <<>> mail.proton.me
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35758
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;mail.proton.me. IN A

;; ANSWER SECTION:
mail.proton.me. 819 IN A 185.70.42.37

;; Query time: 11 msec
;; SERVER: x.x.x.x#53(x.x.x.x)
;; WHEN: Wed Sep 28 11:40:02 UTC 2022
;; MSG SIZE rcvd: 59

clmfsh@magpie:~$ traceroute mail.proton.me
traceroute to mail.proton.me (185.70.42.37), 30 hops max, 60 byte packets
1 x.x.x.x (x.x.x.x) 0.316 ms 0.296 ms 0.768 ms
2 lo0-0.bng4.thn-lon.zen.net.uk (51.148.77.132) 9.975 ms 9.966 ms 9.957 ms
3 lag-14.p1.thn-lon.zen.net.uk (51.148.73.94) 11.165 ms 11.159 ms lag-14.p2.thn-lon.zen.net.uk (51.148.73.96) 9.919 ms
4 lag-2.p1.ixn-lon.zen.net.uk (51.148.73.133) 11.114 ms lag-2.p2.ixn-lon.zen.net.uk (51.148.73.139) 9.893 ms 11.098 ms
5 lag-1.br1.ixn-lon.zen.net.uk (51.148.73.181) 9.876 ms 11.083 ms 11.076 ms
6 lag51.fr5.lcy1.llnw.net (87.248.216.236) 11.067 ms 10.173 ms 10.138 ms
7 siteprotect.security.neustar (68.142.82.33) 10.114 ms 10.690 ms siteprotect.security.neustar (68.142.82.35) 10.535 ms
8 * * *
9 gre01.lcy.siteprotect.security.neustar (156.154.218.0) 10.074 ms 10.066 ms 10.042 ms
10 156.154.253.101 (156.154.253.101) 27.563 ms 156.154.165.61 (156.154.165.61) 27.555 ms 27.546 ms
11 * * *
12 185-70-42-37.protonmail.ch (185.70.42.37) 27.243 ms 29.572 ms 29.552 ms

clmfsh@magpie:~$ wget mail.proton.me
--2022-09-28 11:40:19-- http://mail.proton.me/
Resolving mail.proton.me (mail.proton.me)... 185.70.42.37
Connecting to mail.proton.me (mail.proton.me)|185.70.42.37|:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://mail.proton.me/ [following]
--2022-09-28 11:40:19-- https://mail.proton.me/
Connecting to mail.proton.me (mail.proton.me)|185.70.42.37|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 6400 (6.2K) [text/html]
Saving to: ‘index.html’

index.html 100%[=============================================================================>] 6.25K --.-KB/s in 0s

2022-09-28 11:40:19 (159 MB/s) - ‘index.html’ saved [6400/6400]

Legend! The MTU was correct, but I'd missed the MSS clamping setting.

ProtonMail is now working. I don't quite understand why it only broke Proton and every other site seemed fine. I'm assuming their servers are just particularly sensitive to TCP fragmentation?

Many thanks.