In the US, Comcast does this on all business copper connections. They call it "Secure Edge". It frequently breaks DNS, VPNs, some voip, torrents (or any P2P connections), and probably other stuff. It's enabled by default on all new accounts and will randomly be at the account level.

To disable it you have to call them and ask.