Opened 14 years ago

Closed 14 years ago

#57 closed enhancement (fixed)

REQ: Add MSS Clamping option for interfaces

Reported by: xauser Owned by: Victor Julien
Priority: major Milestone: 0.7
Component: suite Version:
Keywords: Cc:


PROBLEM: Some sites don't work with vuurmuur / SNAT when the router uses pppoe. (For example

REASON: The standard defines a MTU value of 1500 bytes for ethernet frames. When people use pppoe to connect their provider they have to limit their MTU to 1492 because of the 8 bytes for pppoe header information.

When a router A sends a packet to router B which can't handle packages of that size (maybe because of pppoe), router B answers the sender with an ICMP 'Destination unreachable: Fragmentation needed, but DF set.' message. The sender understands this and shrinks its packages to the specified size.

Unfortunately router A could be behind a firewall that blocks these ICMP packages. The sender will never get informed to shrink its packages accordingly and all packages get lost.

FIX MSS Clamping. The Maximum segment size (MSS) is the largest amount of data, specified in bytes, that TCP is willing to send in a single segment. Typically the MSS is negotiated using the MSS option when the TCP connection is established. When using a MSS value of 1452 and adding the TCP and IP headers (40 Bytes) we are at a package size of 1492 what exactly fits through the pppoe connection. This can automatically be done using iptables command:

iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu


Change History (4)

comment:1 by Victor Julien, 14 years ago

Milestone: undecided0.8
Priority: minormajor
Status: newassigned

Would this be a per interface setting or just one global rule?

comment:2 by xauser, 14 years ago

This would be a per interface setting.

pppoeconf for example generates this default rule

iptables -t mangle -o "$PPP_IFACE" --insert FORWARD 1 -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu

comment:3 by Victor Julien, 14 years ago

Milestone: 0.80.7

I've decided to do this in 0.7: changeset:201 is the first step.

comment:4 by Victor Julien, 14 years ago

Resolution: fixed
Status: assignedclosed

Fixed by changeset:202, changeset:203 and changeset:204.

Please let me know if this works for you. Thanks!

Note: See TracTickets for help on using tickets.