Setup: GL-BE3600 (Slate 7), upgraded 4.9.2 → 4.10.0 with settings kept. WireGuard client (Mullvad), global mode, kill switch on. Worked fine on 4.9.2.
Symptom: With the VPN client up, LAN clients (macOS, iOS) load nothing over TCP. Ping, DNS and the admin panel work, and the router's own traffic through the tunnel works too. With the VPN off everything is normal.
Ruled out: DNS/AdGuard Home, routing, firewall zone, MTU. MSS clamping is verified on the wire.
Evidence: tcpdump -ni wgclient1 while a LAN client runs curl https://1.1.1.1/:
10.x.x.x.61547 > 1.1.1.1.443: Flags [S], mss 1340
1.1.1.1.443 > 10.x.x.x.61547: Flags [S.], mss 1340
10.x.x.x.61547 > 1.1.1.1.443: Flags [.], ack 1
10.x.x.x.61547 > 1.1.1.1.443: Flags [P.], seq 1:302, length 301 <- ClientHello
... 10 s: no ACK, and no client retransmits visible on wgclient1 ...
10.x.x.x.61547 > 1.1.1.1.443: Flags [F.], seq 302
1.1.1.1.443 > 10.x.x.x.61547: Flags [.], ack 1, sack 1 {302:303}
Handshake and FIN pass, but the 301-byte data segment never reaches the server, and the client's retransmits never appear on the tune the slow path, established-flowdata is swallowed by the fast path.
Workaround: /etc/init.d/qca-nss-ecm stop and everything loads instantly. start breaks it
again. Fully reproducible.
Likely regression: On 4.9.x an/sys/kernel/debug/ecm/gl_front_end_ipv4_stop=1 (see https://forum.gl-inet.com/t/flint-3-wan-speed-goes-to-500mbit-after-enabling-w 4.10.0 it stays 0 with theWireGuard client up and ECM running. The new selective acceleration logic seems to accelerate
flows that egress via wgclient1.
Probably the same root cause as thi beta2:https://forum.gl-inet.com/t/network-acceleration-causes-permanent-video-stalls-over-vpn-reproduced-on-both-wireguard-and-openvpn-gl-
Happy to provide ecm_dump.sh outp