explicitly allow fragmented packets in ipsec environment - unset the DF bit
Hi I've stumbled over something that appears to be a bit strange to me. I can send 15 Kbyte (I haven't tried larger packets yet but I'm sure they will go through the tunnel as well) pings to the other end of an ipsec (freeswan-freeswan) tunnel. Checking my fragmented packets the DF bit is not set. The other end of the tunnel, however, can "only" send 1500 Byte pings to me. Those packets have the DF bit set. I wonder how it is possible to unset the DF bit in an IP implementation. Or is there a difference between the various linux distributions? My ipsec box is a redhat while the firewall box right behind it is a SuSE box. I also checked the /proc filesystem for an option to disable the DF bit, but could not find anything. Thanks for any suggestions, Philipp
On Friday, 3. October 2003 09:17, you wrote:
I can send 15 Kbyte (I haven't tried larger packets yet but I'm sure they will go through the tunnel as well) pings to the other end of an ipsec (freeswan-freeswan) tunnel. Checking my fragmented packets the DF bit is not set. The other end of the tunnel, however, can "only" send 1500 Byte pings to me. Those packets have the DF bit set.
Hi! The following is taken from /usr/src/linux/Documentation/Configure.help: TCPMSS target support CONFIG_IP_NF_TARGET_TCPMSS This option adds a `TCPMSS' target, which allows you to alter the MSS value of TCP SYN packets, to control the maximum size for that connection (usually limiting it to your outgoing interface's MTU minus 40). This is used to overcome criminally braindead ISPs or servers which block ICMP Fragmentation Needed packets. The symptoms of this problem are that everything works fine from your Linux firewall/router, but machines behind it can never exchange large packets [...] This sounds quite a bit like your problem. One of your systems seems to be unable to send fragmented packets. And as 1500 bytes is probably your MTU, the host that cannot send fragmented packets cannot send packets larger than 1500 bytes. Maybe this is simply because you yourself are blocking the "ICMP Fragmentation Needed packets", so check your firewall rules/logs. If that doesn't help, maybe this kernel option will. Regards nordi -- Denn der Menschheit drohen Kriege, gegen welche die vergangenen wie armselige Versuche sind, und sie werden kommen ohne jeden Zweifel, wenn denen, die sie in aller Öffentlichkeit vorbereiten, nicht die Hände zerschlagen werden. Bertolt Brecht, 1952
participants (2)
-
mailinglists -
nordi