tunrning on ip fragmentation in Fedora core 2

Montaignep · 09-24-2004, 02:19 AM

I am setting up a router with ipsec VPN . It is working OK until the packets get big enough that with the ipsec overhead it goes over the MTU. Fragmentation is then needed but it is by default off.
Can someone tell me how to turn it on ?

r0b0 · 09-24-2004, 06:33 AM

I'd rather suggest changing the MTU to a smaller value.

Montaignep · 09-24-2004, 06:41 AM

This is actually what I did as a work around, lowering it to 1398 did the trick but I have to do that on every single machine on the network. I also have to dig into the config files to find out how to make it permanent under Linux.
But I would still like to know what I have to do to turn defrag on.

Thanks for your reply anyway, your are the first one.

scowles · 09-24-2004, 07:29 AM

I can't tell from your post, but the problem you describe could be iptable related.
Have you looked at the iptable target TCPMSS?

From man iptables:

Code:

   TCPMSS
       This  target  allows to alter the MSS value of TCP SYN packets, to con-
       trol the maximum size for that connection (usually limiting it to  your
       outgoing  interface's MTU minus 40).  Of course, it can only be used in
       conjunction with -p tcp.
       This target is used to overcome criminally braindead  ISPs  or  servers
       which  block  ICMP  Fragmentation Needed packets.  The symptoms of this
       problem are that everything works fine from your Linux firewall/router,
       but machines behind it can never exchange large packets:
        1) Web browsers connect, then hang with no data received.
        2) Small mail works fine, but large emails hang.
        3) ssh works fine, but scp hangs after initial handshaking.
       Workaround:  activate  this option and add a rule to your firewall con-
       figuration like:
        iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
                    -j TCPMSS --clamp-mss-to-pmtu

Montaignep · 09-24-2004, 11:26 AM

Great idea, I did not know about TCPMSS, my man pages does not even mention it.
in fact I use :
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1358
to get my ipsec vpn to work.
So this is a solution to my current problem. But I still would like to know how to turn the defrag on !
Thanks