<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div>I just noticed in the FIOS router
I can set the MTU on the "Broadband
Connection (Coax)" and not just the ethernet. So I set it to 1400 and
now everything works fine since my LAN and all the interfaces on
strongSwan can handle up to 1500 MTU and everything coming from the
internet will be 1414 bytes at the max. It looks like strongSwan is
adding about 76 bytes for ESP bringing the ESP packets to 1490 bytes
which works since it is below the MTU of 1500. So if i set the MTU on my
FIOS router outside interface to 1400 everything works fine.<br></div><div><br></div><div>I
will look into setting the MSS via iptables as you suggested since I am
unsure of other performance problems that having an MTU of 1400 on my
internet connection might bring.<br></div><div><br></div>Mark-<div><br></div> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Mark M <mark076h@yahoo.com><br> <b><span style="font-weight: bold;">To:</span></b> Mark M <mark076h@yahoo.com>; "users@lists.strongswan.org" <users@lists.strongswan.org> <br> <b><span style="font-weight: bold;">Sent:</span></b> Saturday, July 21, 2012 8:18 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [strongSwan] IP Fragmentation problems on some websites<br> </font> </div> <br>
<div id="yiv1073065531"><div><div style="color:#000;background-color:#fff;font-family:times new roman, new york, times, serif;font-size:12pt;"><div><span>I figured out what is going on i think. When strongSwan receives a 1514 <span class="yiv1073065531yshortcuts yiv1073065531cs4-visible" id="yiv1073065531lw_1342915893_0">byte packet</span>
or one that is the full MTU from the outside website it does not have
anymore room to encapsulate it into an ESP packet to be sent back to the
client. I tried setting the MSS values and played around with he MTU
some more and it is still not working. Maybe I am setting the MSS wrong?
on the strongSwan eth0 interface i did "ip route add 192.168.1.1 dev
eth0 advmss 1400" and it still does not work?</span></div><div><br><span></span></div><div><span>Is this the problem with the received packets needing room for the ESP overhead?<br></span></div><div><br><span></span></div><span>Mark-</span><div><br></div> <div style="font-family:times new roman, new york, times, serif;font-size:12pt;"> <div style="font-family:times new roman, new york, times, serif;font-size:12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Mark M <mark076h@yahoo.com><br> <b><span style="font-weight:bold;">To:</span></b> "users@lists.strongswan.org" <users@lists.strongswan.org> <br> <b><span style="font-weight:bold;">Sent:</span></b> Saturday, July 21, 2012 1:14 PM<br> <b><span style="font-weight:bold;">Subject:</span></b> [strongSwan] IP Fragmentation problems on some websites<br> </font> </div> <br>
<div id="yiv1073065531"><div><div style="color:#000;background-color:#fff;font-family:times new roman, new york, times, serif;font-size:12pt;"><div>Hi,</div><div><br></div><div>I got my strongSwan gateway up and running. It is sitting behind my FIOS router and acting as VPN gateway for roadwarrior/mobile clients. I thought everything was working great until i noticed that some websites do not load. The first one i found was <a rel="nofollow" target="_blank" href="http://yahoo.com/">yahoo.com</a>. I fired up Wireshark and noticed when i receive packets back from yahoo.com my strongSwan gateway sends Fragmentation needed ICMP messages back. <br></div><div><br></div><div>Setting the MTU on my strongSwan gateway interfaces had no effect. I then set the MTU on my verizon FIOS router to 1400 and some pages would start to work ok, like yahoo.com would start to work but still others would not with the same fragmentation problem.</div><div><br></div><div>Instead
of putting the
MTU on my FISO router way down and possibly have other
performance problems, is there an easy way to fix this? <br></div><div><br></div><div>Thanks for any help,</div><div><br></div><div>Mark-<br></div></div></div></div><br>_______________________________________________<br>Users mailing list<br><a rel="nofollow" ymailto="mailto:Users@lists.strongswan.org" target="_blank" href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br><a rel="nofollow" target="_blank" href="https://lists.strongswan.org/mailman/listinfo/users">https://lists.strongswan.org/mailman/listinfo/users</a><br><br> </div> </div> </div></div></div><br><br> </div> </div> </div></body></html>