fragmented udp packets

zsoltrenyi · 07-05-2006, 09:06 AM

HI

I have a big problem
I can't forward some fragmented udp packets. They are entering one interface but they are not forwarded to my inside interface. I can capture them on my outside interface. It's not a firewall issue.

I'm using Centos 4 and 2.6.9.34 kernel, I tried also with 2.6.9.5 kernel with same results.
Any ideas?

tgo · 07-06-2006, 07:03 PM

what type of data is being sent? is the dont fragment bit set? you should be able to notice the flag in tcpdump output.

zsoltrenyi · 07-07-2006, 10:38 AM

Well I think it is:

17:37:27.241183 IP (tos 0x20, ttl 58, id 28157, offset 1480, flags [+, DF], proto: UDP (17), length: 1500) yyy > xxx: udp
17:37:27.241202 IP (tos 0x20, ttl 58, id 28157, offset 2960, flags [DF], proto: UDP (17), length: 184) yyy > xxx udp

What should I do?

tgo · 07-07-2006, 07:49 PM

check your mtu with ifconfig and see if its set to some really low value, if it is then make it higher. If this doesnt fix it you can try and rel yon pmtu which you can enable by:

echo 0 >/proc/sys/net/ipv4/ip_no_pmtu_disc

zsoltrenyi · 07-08-2006, 02:12 AM

thank's for your reply

I lowered mtu until 1250 on all interfaces but with no luck, and I couldn't make it higher than 1500. PMTU was already enabled. This same connection works with 2.4 kernel, but I wan't to change my old firewall with a new one. I tried 2.6.9, 2.6.11, 2.6.15 kernel so far. There must be a way to solve this with 2.6 kernel too.
Any help would be appreciated

zsoltrenyi · 07-08-2006, 05:29 AM

I found out that shorewall is causing the problem. I didn't suspected shorewall because I inserted rules to accept everything from the vpn gateway in the forward chain and in the nat table. So I thought it was the kernel. But with shorewall disabled it works. Anybody experienced this with shorewall?
I didn't tell you yet but I'm trying to establish a vpn connection.
Thanks