Incoming ports blocked or extremely slow 80, 443 & 22

[#1]

I have a couple of personal services setup for myself to access on the go, such as a file server and photo server, and I use let's encrypt with certbot to generate certificates, however just recently this has been timing out and I have noticed that accessing the web server and ssh server has become painfully slow if at all accessible when not on the home network. I have port forwarding setup correctly, and this has been working perfectly for nearly a year, but the last few weeks it has really fallen over.

I have restarted the router and open reach box, but this hasn't helped.

What next?

[#2]

Further info, if I disable the firewall completely, this resolve the problem, but obviously that's not an acceptable fix.

[#3]

Are you talking about your (Plusnet?) router firewall?

I don't know if you still have it disabled but if it's any consolation, I can reach your servers and they seem responsive at the moment. Wouldn't explain your firewall observation, but where are you trying to access from when you are off network, and are you entirely certain that your hosted content is all properly secured/free from nasties?

Reason I ask is that I was surprised to see this when attempting access over plain HTTP (this is from an EE broadband line): -

Before overriding that message, HTTPS requests would fail completely.

And a quick check of your domain name using a random reputation site (ssltrust.co.uk) from a Google search: -

Could it be that there are filters applied to the networks you are attempting access from that are blocking attempts because of the above? 🤔

[#4]

Yes, my Plusnet router firewall is currently disabled so I can use the services I have set up. Hence all my ports are showing up as open currently. If I turn the firewall back on, all the ports will show up as closed.
I am trying to access the service externally through mine and my wife mobile phones.
I am currently using a free ddns subdomain, however am in the process of switching to my own domain I recently purchased. This is how I discovered I couldn't generate certificates in the first place.
And yes, my content is all hosted in my house and is safe from nasties. I assume that warning is due to another person using a different subdomain who's isn't safe from nasties.

The problem is that the router has 3 firewall options, default, blocked or off. I want the default option, so no unsolicited connections are allowed, but port forwards are allowed, but currently that setting applies a full block. So I am using off, and have turned ufw and fail2ban back on on my personal server.
The router is faulty. I assume it either needs a firmware update or replacement?

[#5 · Accepted solution]

Have you attempted a full factory reset of the router by inserting something into the pinhole at the rear of the device until the status LED flashes green? You will need to reconfigure your port forward rules etc. but that should eliminate any potential that the router firewall has got itself into a state.

I don't know of any historic firmware builds where port forwarding/the firewall has been broken as you describe.

Another option would be to check the event log under under Advanced > Technical > Event Log (I think) in the Hub Manager/GUI. If there are port forwarding rules being matched, then I'd expect to see reference to them in the Event Log and that might offer some clues.

[#6]

Good ol' factory reset gone done it! 😁 Spent the last few days trying everything, thinking it was a misconfiguration on my server! Glad to resolve it. Thanks

[#7]

Glad to hear it's sorted! 🙂