From: John Hawley <jhawley@bgea.org>
To: Thomas Lussnig <thomas.lussnig@bewegungsmelder.de>
Cc: Netfilter List <netfilter@lists.netfilter.org>
Subject: Re: TCPMSS workaround on OUTPUT?
Date: 30 Sep 2002 09:38:55 -0500 [thread overview]
Message-ID: <1033396735.23494.14.camel@magnum> (raw)
In-Reply-To: <3D937473.4000504@bewegungsmelder.de>
[-- Attachment #1: Type: text/plain, Size: 1355 bytes --]
On Thu, 2002-09-26 at 15:56, Thomas Lussnig wrote:
first your entry is working, but i think that the filter could
"--tcp-flags SYN,RST,ACK SYN"
Because "ACK,SYN" as part 2 of the handshake there the MSS should
already be known.
well, I was just copying ver batim out of the kernel build docs ...
And i think that you should tell the direction (-o ppp+ maybe)
Local packages should know the correct size since the interface (DSL
maybe) have the correct mtu.
ok, so is there a kernel bug? I dont seem to have this problem on
kernels previous to 2.4.18. That is, that the fw machine itself can't
browse these web sites. The two situations I've seen so far are: (1)
fw (kernel 2.4.18) --> Cisco router with fractional T1 and (2) fw
(kernel 2.4.19) --> Lucent Pipeline on ISDN.
Examplke
> ip ad li ppp0
19: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1492 qdisc cbq qlen 3
link/ppp
inet 217.233.244.33 peer 217.5.98.168/32 scope global ppp0
Try this
ip ro ch 10.0.1.0/24 dev eth1 advmss 1490
on my networked this make all things working nice WITHOUT the
clamp-mss-to-pmtu iptables entry.
didn't help
Cu Thomas Lußnig
--
John Hawley
BGEA/ITS <=> Network Admin
612.335.1334
jhawley@bgea.org
[-- Attachment #2: Type: text/html, Size: 3237 bytes --]
prev parent reply other threads:[~2002-09-30 14:38 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-09-26 16:06 TCPMSS workaround on OUTPUT? John Hawley
2002-09-26 20:56 ` Thomas Lussnig
2002-09-30 14:38 ` John Hawley [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1033396735.23494.14.camel@magnum \
--to=jhawley@bgea.org \
--cc=netfilter@lists.netfilter.org \
--cc=thomas.lussnig@bewegungsmelder.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.