From: "Ortwin Glück" <odi@odi.ch>
To: linux-kernel@vger.kernel.org, netdev@vger.kernel.org
Subject: xfrm: is pmtu broken with ESP tunneling?
Date: Mon, 10 Feb 2014 09:41:54 +0100 [thread overview]
Message-ID: <52F890D2.2060109@odi.ch> (raw)
Hi,
I am using Openswan to configure an IPSec VPN (using the xfrm/netkey
backend). Large HTTP POST requests from the client seem to get stuck,
because the outgoing packets are 1530 bytes (before being wrapped into
ESP packets). The problem goes away by setting sysctl
net.ipv4.ip_no_pmtu_disc=1.
May have something to do with it:
The tunneled network is 10.6.6.6/32 and I am SNAT'ing some destinations
to that IP, so they get routed through the tunnel. Any other networks
are not to go through the tunnel.
iptables -t nat -A POSTROUTING -d "${R}" -j SNAT --to-source 10.6.6.6
It seems quite clear to me that xfrm is doing something wrong here.
Ortwin
next reply other threads:[~2014-02-10 8:57 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-02-10 8:41 Ortwin Glück [this message]
2014-02-11 2:32 ` xfrm: is pmtu broken with ESP tunneling? Hannes Frederic Sowa
2014-02-11 20:20 ` Ortwin Glück
2014-02-13 0:01 ` Hannes Frederic Sowa
2014-02-13 19:53 ` Ortwin Glück
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=52F890D2.2060109@odi.ch \
--to=odi@odi.ch \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).