Re: iptables and mtu

Re: iptables and mtu

[lee Leahu]

hi, i solved this on my adsl conn and i thought you could use it.


iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu



basically what this command does, is tell everyone to *NERVER* send any packet with mtu size larger than it can support.


---------- Original Message ----------------------------------
From: "Jörgen" Danielsson <jorgen_d@yahoo.com>
Date:  Mon, 10 Jun 2002 12:49:25 -0700 (PDT)

>
>
>> What is the MTU on the firewall interface connected
>> to the ADSL ?
>>
>> I would have thought that if this was set to 1492,
>> then things should sort
>> themselves out quite transparently...
>>
>
>ppp0 is 1492 and its "connected" to eth0 that is 1500,
>and eth1 is connected to local net and it is 1500
>
>>
>> You *are* allowing the appropriate ICMP messages
>> into / out of / through your
>> firewall box, aren't you ?
>
>Uhmmm, no idea actually, hehe, i just configures it to
>reject or accept access on certain ports, not dropping
>every package coming that isn't matching a certain
>port (hmm, hope anyone understands that sentence).
>Why lock down everything when i know what service that
>is on the linux and on ever computer behind it.
>
>/Jörgen
>
>__________________________________________________
>Do You Yahoo!?
>Yahoo! Health - your guide to health and wellness
>http://health.yahoo.com
>
>

Re: iptables and mtu

[=?unknown-8bit?q?J=F6rgen?= Danielsson]

Thanks

Gonna try that, sounds promising =)

/Jörgen

--- lee Leahu  <lee@ricis.com> wrote:
> 
> hi, i solved this on my adsl conn and i thought you
> could use it.
> 
> 
> iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN
> -j TCPMSS --clamp-mss-to-pmtu
> 
> 
> 
> basically what this command does, is tell everyone
> to *NERVER* send any packet with mtu size larger
> than it can support.
> 
> 


__________________________________________________
Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com

iptables and mtu

[=?unknown-8bit?q?J=F6rgen?= Danielsson]

I'm using an adsl connection and have linux as
router/firewall. The problem is that adsl uses a mtu
that is 1492, standard for ethernet is 1500.

Is there a way to make iptables "convert" packages to
the masqed net to a mtu of 1500 instead ?
Right now i have to manually change the mtu to 1490 on
the computers behind the linux router to be able to
access all websites.

/Jörgen

__________________________________________________
Do You Yahoo!?
Yahoo! Health - your guide to health and wellness
http://health.yahoo.com

Re: iptables and mtu

[Antony Stone]

On Monday 10 June 2002 8:28 pm, "Jörgen" Danielsson wrote:

> I'm using an adsl connection and have linux as
> router/firewall. The problem is that adsl uses a mtu
> that is 1492, standard for ethernet is 1500.
>
> Is there a way to make iptables "convert" packages to
> the masqed net to a mtu of 1500 instead ?

What is the MTU on the firewall interface connected to the ADSL ?

I would have thought that if this was set to 1492, then things should sort 
themselves out quite transparently...

> Right now i have to manually change the mtu to 1490 on
> the computers behind the linux router to be able to
> access all websites.

You *are* allowing the appropriate ICMP messages into / out of / through your 
firewall box, aren't you ?

 

Antony.

Re: iptables and mtu

[=?unknown-8bit?q?J=F6rgen?= Danielsson]

> What is the MTU on the firewall interface connected
> to the ADSL ?
> 
> I would have thought that if this was set to 1492,
> then things should sort 
> themselves out quite transparently...
> 

ppp0 is 1492 and its "connected" to eth0 that is 1500,
and eth1 is connected to local net and it is 1500

> 
> You *are* allowing the appropriate ICMP messages
> into / out of / through your 
> firewall box, aren't you ?

Uhmmm, no idea actually, hehe, i just configures it to
reject or accept access on certain ports, not dropping
every package coming that isn't matching a certain
port (hmm, hope anyone understands that sentence). 
Why lock down everything when i know what service that
is on the linux and on ever computer behind it.

/Jörgen

__________________________________________________
Do You Yahoo!?
Yahoo! Health - your guide to health and wellness
http://health.yahoo.com