After connecting to the VPN, Firefox can’t navigate to sites within the VPN but Chrome can

Networking ▾

Basic :: Networking

for errors in Mozilla’s Standard Networking Library (also known as “Netlib” or “Necko.”) The networking library provides the program interface that Mozilla uses to access physical transports (such as the Internet and local drives), implement URL resolutions, and handle a variety of of networking protocols.

Examples of appropriate errors: URLs containing a backslash were not fetched; URLs that start with a single slash turn into http:/// ; The authenticated FTP site cannot be reached.

From

mark duplicate

Mark as diamond

People

(Reporter: tnmurphy, Designation: CuveeHsu)

details

(the blackboard: [necko-triaged])

It has a regression range:

–

This error is publicly visible.

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, as Gecko) Chrome/61.0.3163.91 Safari/537.36 Reproduction steps: I loaded Firefox then connected to my VPN and then tried to go to an intranet site Inside that VPN. I am using Fedora Linux 26 on amd64. My VPN type is “cisco”. Actual results: My Internet Provider (Virgin Media UK) page appeared for an unknown site. Expected results: Like Google Chrome – Your intranet site should appear. As far as I can tell this is a DNS issue because when I put in the IP addresses, it works. The “host” utility on my machine is returning the correct address. /etc/resolv.conf contains the IP addresses of the VPN name servers. I tried v58 at night on 03 October 2017 and did the same thing, the user agent of the browser I had the problem with was: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0

Operating System: Unspecified → Linux

Hardware: Unspecified → x86_64

As far as I know, this has been a long standing issue and not a downgrade – I’ve encountered this in many previous versions of Firefox.

Component: Untriaged → Networking

Product: Firefox → Core

Hi, I have the same problem in OS X. Let’s describe it in my words. If it is already connected to any network, Firefox will be able to retrieve the data. If the VPN is toggled on/disabled while Firefox is still open, Firefox crashes and appears unable to retrieve any page data. However, Chrome browser can. (Maybe it’s due to changing DNS server issues. Maybe Chrome uses a better mechanism to handle DNS, due to advertising issues, to drive traffic under any circumstances, while Firefox seems to cache DNS server entries?) I’m using Firefox 56.0 (64-bit on OS X) Daniel Do you know if Gecko clears the DNS cache when VPN is enabled/disabled? Firefox will clear the DNS cache when it detects a “network change”, which mainly happens when network interfaces come and go or if they change addresses. Adding, changing, or removing a VPN might do one of those things, so it was supposed to make Firefox clear the DNS cache and other things it does for network changes. The description here makes it seem to me as if the network change that the VPN should be causing wasn’t detected by Firefox. Tim, as you read this, you get this problem when you start Firefox and then VPN. If I do this in the other order i.e. start VPN first and then Firefox, I assume it works correctly then? Also, if you enable HTTP logging [*](And include the ‘nsNotifyAddr’ module) Before starting the VPN and then starting the VPN, it will be interesting to see if Firefox correctly records this as a network change.

[*] = https://developer.mozilla.org/en-US/docs/Mozilla/Debugging/HTTP_logging

Flags: needinfo? (Daniel) → needinfo? (@tnmurphy)

gzipped log from user session. The VPN is turned off, I logged in and set up the logging from about: network added with the nsNotifyAddr module (no numeric parameter defaults to nsNotifyAddr: 0), then I connected to the VPN and turned off the logging. I setup the error and before submitting I decided to try the internal site just to make sure I was reproducing the problem and the darn thing worked (eg I saw the internal site)! Then I did the whole experiment again 3 times and got buggy behavior where I was stuck.

Flags: needinfo? (@tnmurphy)

First I want to apologize because my first log file was from Nightly Firefox – I’m flipping between that and a Linux distro version that was also updated to version 56 of 55. There seems to be a difference between 55/56 and my Nightly build in that the older They never “recover” while now Nightly seems to eventually load intranet pages after a minute or two. 58.0a1 (2017-10-22) (64-bit). I think this is new in the last week or two, I have a similar issue with Firefox 57 b12 and OSX. My VPN client is Cisco. 1. Open Firefox 2. Go to www.google.com -> it works 3. Connect to VPN using Cisco VPN client 4. Try www.google.com again -> It hangs and can be easily reproduced. This does not happen with Chrome. It’s an annoying issue and it makes me think back to Chrome :-((and I’m not linking to that) The funny thing is that this doesn’t happen on another website.Does search engines/google have a special treatment?/assign it to Daniel at the moment.

Agent: Nobody → Daniel

Priority: – → P2

the blackboard: [necko-triaged]

If I forgot to mention, it also shows the correct IP address if I restart the browser, I went back to Firefox from Chrome and was pretty positive about the quantum version. This is the only problem that forces me back to Chrome and I hope this will be fixed soon. Thanks, forgot to mention that I’m using Tunnelblick 3.7.4a (version 4920) on Mac OS X and on GNU/Linux (Debian) I’m using openvpn. Currently also with the latest build at night the problem occurs. However, restarting Firefox is a solution to bypass it. (However, one has to consider the VPN as very unstable, so you may find yourself in a situation, restarting Firefox up to 4 times per hour, which can be very annoying and stressful) Besides Chrome not happening in Chromium Chrome code is open source core. Best regards, AlexIt seems to be related to TCP mandates. We run pfSense as a router. If you clear the states associated with the device running Firefox in the firewall, the problem is “solved”. We are working on something that could help fix this issue but it won’t be available until next year. We may have to contact the firewall company to fix this issue. Alex, are you using the same firewall or another firewall? Hi, I’m using iptables on OS X… Additionally, I’m using “Little Snitch”… However, deactivating it doesn’t change the behavior as described above. I just wanted to report the error. Do not rush to fix it. So any idea when this will be fixed? The last update was 11 months ago and frankly this is very annoying. I’ve switched to Firefox for privacy reasons, but it seems you can’t support a VPN connection while Chrome seems to work flawlessly. I’ll switch browsers if that doesn’t get fixed soon because it’s too annoying and makes Firefox unusable, we “fixed” the problem with our VPN software by forcibly terminating all TCP sockets after the tunnel. This resolved the above problem. What software do you use for a VPN and how do you terminate all sockets?

Status: Unconfirmed → Certain

Ever stressed: True

Agent: Daniel ← Nobody

Status: set → new

This is not the same problem as error 1522673.

Junior, can you take a look at this?

It’s very strange. nsHttpChannel is not created except for portal discovery and telemetry “Network: link state change” in comment 8.
The cached DNS has been cleared, which is fine.

Comment 20 caught my eye because it hints that we may be misusing existing links.
In this case we should have some values ​​of nsHttpChannel

We may need more information based on the records in Comment 7 and Comment 8.
And I can try to reproduce when I get the chance.

Agent: Nobody → Johsoo

Condition: New → Certain

Flags: needinfo? (juhsu)

I can’t reproduce with Viscosity and Tunnelblick in macOS, which comment 9 (local site or public site) indicated

You want to make some progress here.

Is there still a problem with the current version? If yes, can you create an HTTP log with the preset ‘nsNotifyAddr:5’?
It would be good to collect logs such as:
(1) Enable recording
(2) Visit the website by refreshing or entering the URL bar
(3) Enable VPN
(4) Visit the site again (which stops or fails again)

https://developer.mozilla.org/en-US/docs/Mozilla/Debugging/HTTP_logging

Flags: needinfo? (yegors)

Flags: needinfo? (@tnmurphy)

Flags: needinfo? (informations)

I can’t reproduce the problem anymore.

Flags: needinfo? (@tnmurphy)

(in response to Junior [:junior] From comment #26)

You want to make some progress here.

Is there still a problem with the current version? If yes, can you create an HTTP log with the preset ‘nsNotifyAddr:5’?
It would be good to collect logs such as:
(1) Enable recording
(2) Visit the website by refreshing or entering the URL bar
(3) Enable VPN
(4) Visit the site again (which stops or fails again)

These instructions are the wrong way. The unreachable website is inside the VPN – you can’t see it from the outside. The problem is that when Act Connect to VPN, Firefox Still It’s not accessible because somehow it’s still resolving addresses the old-fashioned way. After a long time (10 minutes in my case), the browser catches up with the system but not the way Chrome works very quickly.

(in response to Tim Murphy from comment #31)

(in response to Junior [:junior] From comment #26)

You want to make some progress here.

Is there still a problem with the current version? If yes, can you create an HTTP log with the preset ‘nsNotifyAddr:5’?
It would be good to collect logs such as:
(1) Enable recording
(2) Visit the website by refreshing or entering the URL bar
(3) Enable VPN
(4) Visit the site again (which stops or fails again)

These instructions are the wrong way. The unreachable website is inside the VPN – you can’t see it from the outside. The problem is that when Act Connect to VPN, Firefox Still It’s not accessible because somehow it’s still resolving addresses the old-fashioned way. After a long time (10 minutes in my case), the browser catches up with the system but not the way Chrome works very quickly.

Thanks for the description and the record.
I mentioned step (2) because some people are also struggling with public sites.

Hi Tim,
Can you also provide a record of a good intranet access state?
The main file is sufficient (i.e. not a child)

Thanks!

Flags: needinfo? (@tnmurphy)

(in response to Junior [:junior] From comment #33

Hi Tim,
Can you also provide a record of a good intranet access state?
The main file is sufficient (i.e. not a child)

Thanks!

Good case hostname instead of IP address.
look…

[ad_1]
Don’t forget to share this post with friends !