Connectivity issue to Hedera Mainnet

[donaldthibeau]

RST_STREAM errors on every connection attempt from developer. Connection attempted with each Mainnet Node.

• Network admin confirmed ports are open.
• IP address was shared with Hedera and whitelisted.
• Connection works if the developer uses his mobile phone as a hotspot

[nathanklick]

@donaldthibeau @gregscullard Do we have any additional information regarding their IP address ranges and network infrastructure?

If he can access the network using a mobile hotspot, then it appears based on the information provided that it is a configuration issue on his corporate network.

Here are some random WAG's as to what is happening:

• Corporate Firewall has HTTP & TLS deep inspection/intercept enabled and is not configured for or capable of parsing HTTP/2 payloads.
• Corporate Firewall has HTTP & TLS deep inspection/intercept enabled and is denying the traffic.
• Corporate Firewall has HTTP & TLS deep inspection/intercept enabled and our proxies are denying the traffic flow because they see it as a MITM attack.
• Corporate Firewall does have HTTP inspection enabled and client is using plain-text transport. Corporate Firewall is interrupting traffic flow due to a policy or inspection rule violation.
• Corporate Firewall does have HTTP/1.1 inspection enabled but HTTP/2 inspection is disabled or the firewall is incapable of HTTP/2 inspection.

[jsindy]

@nathanklick would an option be for them be to test with our SSL enabled port 50212?

[nathanklick]

@jsindy If they have not already tested using TLS, then it would definitely be worth a try to further isolate the issue.

If it works with TLS enabled but not over plain-text channels, then it would indicate that they either do not have TLS inspections enabled or they have TLS inspections configured properly for HTTP/2 protocols.

The could also be requiring all HTTP based traffic to be conducted over TLS since most of the current mainstream websites are all TLS enabled with the ongoing trends over the last 3 years. I have seen several corporate policies recently that require all HTTP communications to be over HTTPS with TLS 1.2+ and are enforcing the policy at the firewall level.

[gregscullard]

@nathanklick @jsindy developer reports ports aren't blocked by firewall and connection doesn't work over 50212 either.

[jsindy]

Does their firewalls do deep packet inspection and can they view the firewall logs to determine if it could be blocked that way?

[iron4548]

I'm having this issue too (RST_STREAM errors). Tried using Client.forMainnet(), Client.forTestnet() and custom networks. All I'm doing is trying to get the account balance just to check if it works.

const client = Client.forMainnet();

client.setOperator(myAccountId, myPrivateKey);

//Verify the account balance
const accountBalance = await new AccountBalanceQuery()
        .setAccountId(myAccountId)
        .execute(client);

I'm behind a corporate firewall as well.

I plan to create a IS helpdesk ticket, but need information to forward to them about what to try and help me isolate the problem. Any suggestion?

[netopyr]

Closed due to inactivity. Please reopen if you think the issue is still relevant.