[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Need to remove the Don't Fragment bit

I'm experimenting with ipsec+transport_mode+ipip_tunnels and I found that a big MTU on the ipip interface is a problem when ipsec is working in transport mode, I had to lower it to the real MTU - overheads. The ipip tunnel has pmtu disabled so packet fragmentation inside the ipsec virtual interface is allowed and the "real" packet on the wire is not fragmented. Now I'm having a problem. Usually forwarded packets come with the DF bit set, this is not a problem because PMTU works perfectly on the LANs+VPNs, but when packets come from the Internet (MASQUERADE) with the DF bit set and they need to go through a tunnel and get fragmented the Internet hosts usually don't get the corresponding icmp message and pmtu becomes useless. I solved this by lowering the MSS of the packets exchanged between VPNS and the Internet. I'd like to remove the DF on the packets that need to go through the VPNs to see what happens. Is this possible with an iptables module? I searched the web and the patch-o-matic list and I can't realize which one is the one I need.

	Thanks in advance to everyone.


Reply to: