USG310 - Web Configurator slow to unusable over SSH tunnel

Rafff · March 2020

We always used to remotely administrer our beloved USG300 with Web Configurator interface tunneled over an SSH connection.

Client PC with Firefox (https) --> SSH --> LAN server --> USG300

We just powered up the USG310, did initial setup and connected it to the LAN. HTTPS Web interface works smoothly from a LAN client. On the other hand, it is deadly slow when connecting from a remote PC over the same SSH tunnel we use for USG300.

Opening the login form takes ages but, once pressed the LOGIN button, the page load stucks forever and no Web Configurator interface is ever shown.

Zyxel_Jerry · March 2020

Hi @Rafff

You can check if the SSH service is enabled on the device.

In the default setting, SSH is not allow to the device.

Go to Configuration > Object > Service > Service Group > select the Default_Allow_From_WAN_To_ZyWALL > click Edit

Add SSH into the Default_Allow_From_WAN_To_ZyWALL

Rafff · March 2020

SSH?? The problem was with HTTPS not with SSH! As per my previous message, the SSH tunnel is created to a LAN Server, not to the USG310. The HTTPS works well over LAN.

Anyway, the problem looks solved now that one WAN interface on the USG310 has been activated. In my opinion the problem had something to do with eventual reverse DNS resolution performed by Zyxel on HTTPS requests, maybe for logging purposes, who knows. I do not have time to investigate now, but I've seen similar behaviour before on other appliances and was related to server DNS resolution timeout failure on client connection requests (e.g. security reverse lookups in vsftpd)