Overview

When you are unable to access certain websites while connected to the ONT Wi-Fi, the root cause is typically one of five issues: DNS resolution failure, MTU/MSS mismatch, firewall or ACL blocking, VLAN-to-WAN binding errors, or upstream routing policy. This FAQ answers the highest-intent pre-sales and post-sales questions that B2B network architects, ISP support teams, and enterprise buyers ask about ONT Wi-Fi website access failures. Each answer leads with a direct, definitive response optimized for Google Featured Snippets and AI Overviews.

Frequently Asked Questions

Q1: Why can I access some websites but not others while connected to the ONT Wi-Fi?

The most common cause is DNS resolution failure, where the ONT's DNS proxy cannot resolve specific domain names. This occurs when the ONT forwards DNS queries to a single upstream resolver that is unreachable or rate-limited. Fix it by manually setting primary and secondary DNS servers (for example, 8.8.8.8 and 1.1.1.1) in the ONT's DHCP pool settings, or by configuring a static DNS entry on the client device to test bypass behavior.

Q2: Can an MTU mismatch on the ONT cause certain websites to fail while others load?

Yes. An MTU mismatch on the ONT causes larger HTTPS or CDN-delivered pages to fail while smaller sites load normally. When the ONT WAN MTU is set to 1500 but the ISP requires PPPoE at 1492, packets larger than 1492 bytes are silently dropped because ICMP fragmentation-needed messages are blocked. Set the correct WAN MTU (1492 for PPPoE, 1500 for DHCP) and enable MSS clamping to 1452 on the ONT LAN interface.

Q3: What is the maximum throughput of a typical B2B ONT, and can throughput limits block website access?

A typical enterprise ONT delivers 1 Gbps to 10 Gbps per PON port with a backplane capacity of 20 Gbps to 80 Gbps. Throughput limits rarely block individual websites, but oversubscribed PON uplinks can cause TCP timeouts that appear as selective website failures. Verify the ONT optical module RX power is between -8 dBm and -27 dBm; a weak signal increases retransmissions and makes high-latency sites unreachable.

Q4: How do firewall and ACL rules on the ONT block specific websites?

Firewall and ACL rules on the ONT block specific websites by filtering outbound traffic on port 80, 443, or by destination IP range. Many ONTs ship with a default URL filter or parental control profile that blocks categories such as streaming or social media. Review the ONT security profile, disable URL filtering, and confirm no ACL is bound to the Wi-Fi SSID VLAN. Use the CLI command show acl binding to identify active filter rules.

Q5: What basic CLI configuration steps resolve ONT Wi-Fi website access issues?

The basic CLI fix is to verify DNS, MTU, and VLAN binding in sequence. Log in via console or SSH and run: show wan status, show dns proxy, show interface mtu, and show vlan binding. If DNS shows zero responses, set dns primary 8.8.8.8 and dns secondary 1.1.1.1. If MTU is 1500 on a PPPoE WAN, set interface wan mtu 1492 and tcp mss clamp 1452. Commit with save config.

Q6: How does stacking or virtual chassis configuration affect ONT Wi-Fi website access?

Stacking or virtual chassis misconfiguration affects ONT Wi-Fi website access when the uplink port is not included in the active stack member's forwarding domain. If the ONT is managed by a stacked access switch, traffic from the Wi-Fi VLAN may loop or blackhole because the stack's inter-switch link is down or the stacking interface is not in trunk mode. Verify stacking port status with show stack status and confirm the Wi-Fi VLAN is allowed on the stacking trunk.

Q7: Can redundant power supply failover on the ONT cause temporary website access loss?

Yes. Redundant power supply failover on the ONT can cause temporary website access loss if the standby PSU is faulty or the failover threshold is too slow. During failover, the ONT may reset its optical module and renegotiate the PON link, dropping active TCP sessions for 10 to 30 seconds. Test failover quarterly, replace suspect PSUs, and verify the ONT boot time is under 30 seconds to minimize session loss.

Q8: Why do certain websites fail only on ONT Wi-Fi but work on a mobile hotspot?

Websites that fail only on ONT Wi-Fi but work on a mobile hotspot indicate an ONT-side DNS, MTU, or firewall issue rather than a website outage. Mobile hotspots use different DNS resolvers and lower MTU values, bypassing the ONT's faulty configuration. Isolate the issue by connecting a laptop directly to the ONT LAN port with a static IP and the same DNS settings; if the site loads, the fault is in the ONT Wi-Fi radio, VLAN, or DHCP pool configuration.