Heavy incoming packetloss, when pinging from outside; outgoing is ok

​@Volker Butterstein 

Using a VPN is a good recipe for getting banned by KPN. Can you exempt the KPN emailadresses from going through the VPN ?

I don’t use KPN email at all. The VPN from outside is for accessing my home assistant (Linux Server for home automation). So there is no reason from KPN to ban me. That's IMO a normal and legit use of my Internet connection.

I wonder why that is?
 

Hi ​@Volker Butterstein, welcome on our board. 

It’s important to determine whether there is actual packet loss and where exactly it occurs. I recommend running a test using PingPlotter to identify where the loss happens and especially at which hop. Could you try this?

Hi Alex,

this is a Screenshot of Ping Plotter from a foreign Network (External at my neighbor) to my current IP of my Fritzbox:

No Network Device between Fritzbox and XGS-PON.

The Routing and packet los the other way (from my Network to the foreign network a my neighbor) look normal and has a different routing:

I hope this gives you some insights.

I appreciate your help! Thanks

Volker

Hi Volker,

Try if you can do a traceroute. I find it more clearly.
You can make a screenshot, without show your or your neighboor’s public IP adres.
 

Traceroute from my Network to neighbor(direction outside):

1  <internal IP of my fritzbox>  3.288 ms  3.194 ms  6.806 ms

2  <external IP of neigbor>  8.350 ms  6.234 ms  6.965 ms

Traceroute from neighbor network to my IP (direction to my network):

1  * <internal IP of neighbors net>  5.897 ms  6.168 ms

2  195-190-228-142.fixed.kpn.net (195.190.228.142)  13.684 ms  36.021 ms *

3  * * *

4  195-190-228-142.fixed.kpn.net (195.190.228.142)  70.514 ms  64.594 ms  12.875 ms

5  * <my external IP>  21.004 ms !X  20.005 ms !X

This traceroute last some seconds and will not work every time.

Thanks for help

Volker 

The "21.004 ms !X" and "20.005 ms !X" near your external IP suggest the packets are being administratively prohibited or filtered at your firewall or network edge, leading to failed traceroute completion sometimes.

Also:

Due to firewall configurations etc your traceroute results and their occasional failures are consistent with network devices on either side of your boundary (firewalls, routers) filtering or blocking ICMP/traceroute packets. This is normal behavior to enhance security but can cause traceroute to show incomplete paths or timeouts.

Does your firewall accept ICMP packages?
 

On my side there is a simple fritzbox 7590 supplied by KPN. No special configuration on the outside interface. No ICMP blocking. Roughly every second or third packet gets a response.