[uOS 1.39] Problems with HTTPS sessions

Options
Dylan96
Dylan96 Posts: 47
Zyxel Certified Network Administrator - Nebula Zyxel Certified Network Administrator - Security First Comment Friend Collector
image  Freshman Member
in USG FLEX H Series

After updating to 1.39, we noticed, particularly on the 200H models but also on some 100H models, a significant increase in "log deny wan-to-device" entries. Specifically, I’ve noticed that the destination IP is my public IP, and the source always appears to be legitimate websites.

image.png

Since the destination port is always an ephemeral port, I suspect this is related to an issue with HTTPS sessions.

Has anyone else encountered this behavior?

Accepted Solution

  • Zyxel_Judy
    Zyxel_Judy Posts: 2,753
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula
    image  Zyxel Employee
    Answer ✓
    Options

    Hi @Dylan96 , @Mk88_it ,

    Thank you for your time and for joining the remote sessions, which allowed us to investigate the issue. Here's a summary of the case:

    The firewall's fragmentation mechanism was not functioning correctly, causing some fragmented packets to be dropped by the firewall after being split. This specifically affected your environment, where the MTU needed to be set to a value other than the default 1500.

    A solution was provided to you, and you confirmed the issue was resolved. This fix will be included in the next firmware release, 1.40, scheduled for Q4 2026.

    Zyxel_Judy

All Replies

  • PeterUK
    PeterUK Posts: 4,738
    250 Answers 2500 Comments Friend Collector Ninth Anniversary
    image  Guru Member
    edited August 7
    Options

    Yes the issue is and I see it too

    Screenshot 2026-08-07 164619.png

    I have narrowed the issue down to it being UDP show wrong blocked logs

    hmm this is odd…let me think about what I'm seeing in packet capture

    so on my FLEX 200H I have a test WAN as 192.168.177.3 Ge3 and LAN Ge4 192.168.255.243/26

    this is what the client sends

    Client.png

    and this the the WAN FLEX send

    FLEX H WAN.png

    but why is this traffic being sent out in red?

  • Mk88_it
    Mk88_it Posts: 86
    First Comment Friend Collector Fourth Anniversary
    image  Ally Member
    Options

    @PeterUK maybe do you mean TCP?

  • PeterUK
    PeterUK Posts: 4,738
    250 Answers 2500 Comments Friend Collector Ninth Anniversary
    image  Guru Member
    edited August 7
    Options

    nope I think this is just UDP if you firewall on client for doing TCP only and allow DNS I don't see the issue I'm not sure if it just QUIC or might happen to other UDP traffic.

  • Mk88_it
    Mk88_it Posts: 86
    First Comment Friend Collector Fourth Anniversary
    image  Ally Member
    Options

    Mmh, but in our cases it seems the TCP handshake completes successfully and the TLS Client Hello is transmitted. Subsequently, the client starts retransmitting packets while the server generates Duplicate ACKs and repeated FIN/ACK retransmissions. This suggests that packets belonging to an already established session are being lost or not correctly associated with the existing state entry after NAT translation. In that cases we can see in the packet capture a lot of TCP retrasmission and in the firewall logs like this (dest ip is WAN1 and WAN2)

    image.png
  • PeterUK
    PeterUK Posts: 4,738
    250 Answers 2500 Comments Friend Collector Ninth Anniversary
    image  Guru Member
    edited August 7
    Options

    Think your seeing something different Mk88_it to Dylan96

    Your looks like background Radiation due to WAN IP being on the front line

    Unless the TCP happens because of that? just checked TCP seems fine

  • Mk88_it
    Mk88_it Posts: 86
    First Comment Friend Collector Fourth Anniversary
    image  Ally Member
    Options

    FYI: Zyxel has confirmed that there are issues with 1.39 firmware regarding routing / MTU / VPN in certain scenarios.

  • Zyxel_Judy
    Zyxel_Judy Posts: 2,753
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula
    image  Zyxel Employee
    Answer ✓
    Options

    Hi @Dylan96 , @Mk88_it ,

    Thank you for your time and for joining the remote sessions, which allowed us to investigate the issue. Here's a summary of the case:

    The firewall's fragmentation mechanism was not functioning correctly, causing some fragmented packets to be dropped by the firewall after being split. This specifically affected your environment, where the MTU needed to be set to a value other than the default 1500.

    A solution was provided to you, and you confirmed the issue was resolved. This fix will be included in the next firmware release, 1.40, scheduled for Q4 2026.

    Zyxel_Judy

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）