# Corporate Firewall Issues
**URL:** https://forum.syncthing.net/t/corporate-firewall-issues/27133
**Category:** Support
**Created:** [September 18, 2026, 7:54am UTC](https://forum.syncthing.net/t/corporate-firewall-issues/27133 "2026-09-18T07:54:23Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@defmacr0](https://forum.syncthing.net/u/defmacr0)
#### Post date: [September 18, 2026, 7:54am UTC](https://forum.syncthing.net/t/corporate-firewall-issues/27133/1 "2026-09-18T07:54:23Z")
Hi everyone,
Sometime in the last 2 weeks or so my setup behind a corporate firewall has stopped working (v2.1.5, Windows (64-bit Intel/AMD)). Since the firewall inserts a man-in-the-middle to re-encrypt all SSL traffic, I’m pretty used to this causing various certificate issues. Also, the firewall blocks non-standard ports. Indeed the logs show this:
> 2026-09-18 09:37:27 WRN Failed to fetch latest release information (error=“Get “[https://upgrades.syncthing.net/meta.json\](https://upgrades.syncthing.net/meta.json%5C)”: remote error: tls: illegal parameter” log.pkg=upgrade)
and later a long string of:
> 2026-09-18 09:38:32 INF Relay listener starting (id=dynamic+https://relays.syncthing.net/endpoint log.pkg=connections)
> 2026-09-18 09:38:32 INF Relay listener shutting down (id=dynamic+https://relays.syncthing.net/endpoint log.pkg=connections)
> 2026-09-18 09:38:32 WRN Service failed (error=“Get “[https://relays.syncthing.net/endpoint\](https://relays.syncthing.net/endpoint%5C)”: remote error: tls: illegal parameter” supervisor=listenerSupervisor@dynamic+https://relays.syncthing.net/endpoint service=dynamic+https://relays.syncthing.net/endpoint log.pkg=svcutil)
which repeats every 30s. However, my setup used to work pretty flawlessly out of the box for almost 2 years and there is nothing in the changelog that suggests changes to TLS. Also I cannot find a configuration option that affects TLS either. If I access the relays.syncthing .net/endpoint URL with a web browser it works fine too. Not sure what I can do to fix this.
Would appreciate anyone who’s able to help.
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [September 18, 2026, 10:13am UTC](https://forum.syncthing.net/t/corporate-firewall-issues/27133/2 "2026-09-18T10:13:45Z")
”Illegal parameter” is probably our ingress gateway not approving of whatever cipher suites your proxy is trying to enforce. Not sure why it works from a browser, perhaps the result is a function of the TLS negotiated by the client (ie Syncthing vs the browser) to the proxy.
---
### Author:  [@Nummer378](https://forum.syncthing.net/u/Nummer378)
#### Post date: [September 18, 2026, 2:46pm UTC](https://forum.syncthing.net/t/corporate-firewall-issues/27133/3 "2026-09-18T14:46:43Z")
Packet captures of the failing TLS handshakes could give some insight into what’s going on. Ideally both sides of the proxy, but that may be difficult for you.
---
### Author:  [@defmacr0](https://forum.syncthing.net/u/defmacr0)
#### Post date: [September 18, 2026, 3:40pm UTC](https://forum.syncthing.net/t/corporate-firewall-issues/27133/4 "2026-09-18T15:40:02Z")
Ok, i captured the packets from my PC and did some sleuthing. It seems like the most likely “culprit” is go expanding its support for post-quantum crypto, which this stupid outdated firewall most likely does not support. Probably some upgrade of the go build, I guess it has to be 1.27, causes the firewall to forward corrupted packets. For example i found this issue:
>
>
> \# Go 1.27 TLS 1.3 ClientHello Size Enlargement (~1.5KB) with ML-KEM/ML-DSA Cause…s Middlebox Handshake Stalls
>
> \## Issue Summary
> Starting in Go 1.27 (\`go1.27rc1\` / \`go1.27rc2\`), default TLS 1.3 clients (\`tls.Config{}\`) advertise both \*\*ML-KEM 768\*\* key exchange (\`X25519MLKEM768\` / \`0x11ec\`) and \*\*ML-DSA\*\* signature algorithms (introduced in upstream Go commit \`c74ba7d265519fab5794e5b69e4e9f6c25b45582\`).
>
> The resulting \`ClientHello\` payload size expands to \*\*~1,467 bytes\*\* (exceeding standard 1,200-1,400 byte network MTU / middlebox buffer limits). When connecting through legacy network middleboxes, firewalls, or ingress proxies (such as Envoy/Istio without PQC extension support), the enlarged \`ClientHello\` frame is silently dropped or causes the proxy connection to stall, leading to \`net/http: TLS handshake timeout\` errors.
>
> \---
>
> \## Culprit Commit in Upstream Go Repository
> \* \*\*Commit\*\*: \`c74ba7d265519fab5794e5b69e4e9f6c25b45582\`
> \* \*\*Gerrit CL\*\*: https://go-review.googlesource.com/c/go/+/776709
> \* \*\*Title\*\*: \`crypto/tls: add ML-DSA support\` (Fixes #78888)
>
> \---
>
> \## Standalone Vanilla Reproduction Code
>
> \### 1. \`client.go\` (Vanilla Go TLS Client Diagnostic)
> Zero-dependency, standard library Go TLS client to compare connection modes.
>
> \`\`\`go
> package main
>
> import (
> "crypto/tls"
> "flag"
> "fmt"
> "net"
> "net/http"
> "os"
> "runtime"
> "strings"
> "time"
> )
>
> func curveName(id tls.CurveID) string {
> switch id {
> case tls.X25519MLKEM768:
> return "X25519MLKEM768 (ML-KEM 768 / Kyber)"
> case tls.X25519:
> return "X25519"
> case tls.CurveP256:
> return "P-256"
> case tls.CurveP384:
> return "P-384"
> default:
> if id == 0 {
> return "None"
> }
> return fmt.Sprintf("0x%04x", uint16(id))
> }
> }
>
> func tlsVersionName(version uint16) string {
> switch version {
> case tls.VersionTLS13:
> return "TLS 1.3"
> case tls.VersionTLS12:
> return "TLS 1.2"
> default:
> return fmt.Sprintf("0x%04x", version)
> }
> }
>
> type testConfig struct {
> name string
> tlsConfig \*tls.Config
> }
>
> func testTLS(target string, timeout time.Duration, tc testConfig) {
> fmt.Printf("--------------------------------------------------------------------------------\\n")
> fmt.Printf("Mode: %s\\n", tc.name)
> fmt.Printf("--------------------------------------------------------------------------------\\n")
>
> host, \_, err := net.SplitHostPort(target)
> if err != nil {
> host = target
> target = net.JoinHostPort(target, "443")
> }
>
> cfg := tc.tlsConfig.Clone()
> if cfg.ServerName == "" {
> cfg.ServerName = host
> }
> cfg.InsecureSkipVerify = true
>
> client := &http.Client{
> Transport: &http.Transport{
> TLSClientConfig: cfg,
> DialContext: (&net.Dialer{
> Timeout: timeout,
> }).DialContext,
> TLSHandshakeTimeout: timeout,
> },
> Timeout: timeout,
> }
>
> url := fmt.Sprintf("https://%s", target)
> start := time.Now()
> resp, err := client.Get(url)
> elapsed := time.Since(start)
>
> if err != nil {
> fmt.Printf("Status: ❌ FAILED (%.3fs)\\n", elapsed.Seconds())
> fmt.Printf("Error: %v\\n\\n", err)
> return
> }
> defer resp.Body.Close()
>
> state := resp.TLS
> fmt.Printf("Status: ✅ SUCCESS (%.3fs)\\n", elapsed.Seconds())
> fmt.Printf("Version: %s\\n", tlsVersionName(state.Version))
> fmt.Printf("Cipher: %s\\n", tls.CipherSuiteName(state.CipherSuite))
> fmt.Printf("Group: %s\\n\\n", curveName(state.CurveID))
> }
>
> func main() {
> targetFlag := flag.String("target", "", "Target host:port to test")
> timeoutFlag := flag.Duration("timeout", 5\*time.Second, "Timeout duration")
> flag.Parse()
>
> target := \*targetFlag
> if target == "" {
> if flag.NArg() \> 0 {
> target = flag.Arg(0)
> } else {
> fmt.Println("Usage: client -target \")
> os.Exit(1)
> }
> }
>
> if !strings.Contains(target, ":") {
> target = net.JoinHostPort(target, "443")
> }
>
> fmt.Printf("================================================================================\\n")
> fmt.Printf("TLS Client Diagnostic Tool\\n")
> fmt.Printf("Go Runtime Version: %s\\n", runtime.Version())
> fmt.Printf("Target: %s\\n", target)
> fmt.Printf("================================================================================\\n\\n")
>
> testTLS(target, \*timeoutFlag, testConfig{
> name: "1. Default TLS 1.3 (Runtime Defaults)",
> tlsConfig: &tls.Config{
> MinVersion: tls.VersionTLS13,
> MaxVersion: tls.VersionTLS13,
> },
> })
>
> testTLS(target, \*timeoutFlag, testConfig{
> name: "2. TLS 1.3 with Explicit ML-KEM Curve Preference",
> tlsConfig: &tls.Config{
> MinVersion: tls.VersionTLS13,
> MaxVersion: tls.VersionTLS13,
> CurvePreferences: \[\]tls.CurveID{tls.X25519MLKEM768, tls.X25519},
> },
> })
>
> testTLS(target, \*timeoutFlag, testConfig{
> name: "3. TLS 1.3 without ML-KEM (Standard Curves: X25519, P-256, P-384)",
> tlsConfig: &tls.Config{
> MinVersion: tls.VersionTLS13,
> MaxVersion: tls.VersionTLS13,
> CurvePreferences: \[\]tls.CurveID{tls.X25519, tls.CurveP256, tls.CurveP384},
> },
> })
>
> testTLS(target, \*timeoutFlag, testConfig{
> name: "4. Forced TLS 1.2 (MaxVersion = VersionTLS12)",
> tlsConfig: &tls.Config{
> MinVersion: tls.VersionTLS12,
> MaxVersion: tls.VersionTLS12,
> },
> })
> }
> \`\`\`
>
> \---
>
> \## Behavior Matrix
>
> | Connection Mode | Go 1.25 / 1.26 | Go 1.27 (Default \`tlsmlkem=1\`) | Middlebox Impact |
> | :--- | :--- | :--- | :--- |
> | \*\*Default TLS 1.3\*\* | ✅ SUCCESS (~239B ClientHello) | ❌ TIMEOUT (~1,467B ClientHello) | Connection stall / packet drop |
> | \*\*Explicit ML-KEM\*\* | ✅ SUCCESS | ❌ TIMEOUT (~1,457B ClientHello) | Connection stall / packet drop |
> | \*\*Standard Curves Only\*\* | ✅ SUCCESS | ✅ SUCCESS | Bypasses middlebox drop |
> | \*\*Forced TLS 1.2\*\* | ✅ SUCCESS | ✅ SUCCESS | Bypasses middlebox drop |
Which causes a timeout in that issue, but obviously it could be a number of other things that the firewall here does to the packets that it can’t quite parse. Running syncthing with: `$env:GODEBUG = "tlsmlkem=0"` “fixes” the issue for now.
---
### Author:  [@system](https://forum.syncthing.net/u/system)
#### Post date: [October 18, 2026, 3:40pm UTC](https://forum.syncthing.net/t/corporate-firewall-issues/27133/5 "2026-10-18T15:40:49Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.