Need to remove the Don't Fragment bit
Hello,
I'm experimenting with ipsec+transport_mode+ipip_tunnels and I found
that a big MTU on the ipip interface is a problem when ipsec is working
in transport mode, I had to lower it to the real MTU - overheads. The
ipip tunnel has pmtu disabled so packet fragmentation inside the ipsec
virtual interface is allowed and the "real" packet on the wire is not
fragmented.
Now I'm having a problem. Usually forwarded packets come with the DF
bit set, this is not a problem because PMTU works perfectly on the
LANs+VPNs, but when packets come from the Internet (MASQUERADE) with the
DF bit set and they need to go through a tunnel and get fragmented the
Internet hosts usually don't get the corresponding icmp message and pmtu
becomes useless. I solved this by lowering the MSS of the packets
exchanged between VPNS and the Internet.
I'd like to remove the DF on the packets that need to go through the
VPNs to see what happens. Is this possible with an iptables module? I
searched the web and the patch-o-matic list and I can't realize which
one is the one I need.
Comments?
Thanks in advance to everyone.
--
Koba
Reply to: