Changing AdvLinkMTU when using NPt
-
^^^^
Where's this 6rd coming from? I thought the OP was talking about he.net, which uses 6in4 over a configured tunnel. 6rd is a method used by some ISPs to provide IPv6, using the ISPs IPv4 addresses. While both methods use a tunnel for IPv6, the set up is quite different.Op was using a GIF INterface and I assume he.net tunnel.
FuN_KeY is using 6rd.
-
AC3200 is acting as my main gateway, and I want to use it as DHCP server for local and VPN clients.
If they were using 6rd, there'd be no need for he.net. Either method creates an IPv6 tunnel, but you wouldn't use both. So, it's either 6rd or he.net. Take your pick.
-
I was able to capture the packet too big on wireshark. Everything looks good, except for my Windows 10 client that appear to ignore this value.
-
I was able to capture the packet too big on wireshark. Everything looks good, except for my Windows 10 client that appear to ignore this value.
So, it continues to send 1500 byte packets, despite the too big message? I certainly never had a problem running Windows on IPv6, back when I used a tunnel.
-
I was able to capture the packet too big on wireshark. Everything looks good, except for my Windows 10 client that appear to ignore this value.
So, it continues to send 1500 byte packets, despite the too big message? I certainly never had a problem running Windows on IPv6, back when I used a tunnel.
Agreed,, I have never had an issues with PMTUD on Winows since XP..
-
I was able to capture the packet too big on wireshark. Everything looks good, except for my Windows 10 client that appear to ignore this value.
Any 3rd party firewall?/security software? Have you made any canges to the windows firewall.
-
Nope, vanilla windows 10 (tested on the host and in a VM with a fresh windows install)
I did attach 2 captures. In the first one, one can see the packet too big. And in the second you can see some errors beyond my basic understanding of wireshark.
I did filter the capture over traffic towards a web site (www.swisscom.ch) + icmpv6. Sadly the website I am having problem with uses SSL, so the capture is not that clear.
If I edit the services.inc to let radvd advertise a MTU of 1280 (or even 1480 - despite the 6RD being configured to use 1280) everything works fine.
 -
I haven't seen those errors before either, however it appears something might be corrupting the Ethernet frames. There's the malformed packet error, which means there was a problem somewhere causing bit errors in the frame. That might also be the cause of the segment errors. There's not enough info shown to know where the problem is coming from. Do other computers have the same problem? If only one has the problem, I'd suspect something like a defective NIC. The 1480 MTU shows PMTUD is working. What other equipment is there between the Windows computer and pfSense? Again those malformed packet, frame check sequence incorrect errors make me suspect hardware.
-
I just thought of something to. Is that the only site you have an issue with when you let it advertised a 1500 MTU. Because I noticed something from that site when I ran a certain test to it. I'll link and show it in a minute when I get a chance
-
I just thought of something to. Is that the only site you have an issue with when you let it advertised a 1500 MTU. Because I noticed something from that site when I ran a certain test to it. I'll link and show it in a minute when I get a chance
The site shouldn't cause Ethernet frame errors, as he appears to be getting.
-
I just thought of something to. Is that the only site you have an issue with when you let it advertised a 1500 MTU. Because I noticed something from that site when I ran a certain test to it. I'll link and show it in a minute when I get a chance
The site shouldn't cause Ethernet frame errors, as he appears to be getting.
Agreed. But I'm wondering if there's not two issues and while that is of course a problem maybe not the problem for that site.
See this
https://www.ipv6alizer.se?address=https://www.swisscom.ch
Vs
https://www.ipv6alizer.se?address=https://Www.facebook.com -
Wow, the "Output" on that site is impossible to read, with the faint green text. I had to cut 'n paste it into another app, to read it. Why do some people create sites that are unreadable?
-
Yep this is strange. I did some more testing, and I am also getting weird errors when I set router advertisement to 1280 (but traffic works, beside wireshark, everything is green)
I am unsure about bad hardware, as ipv4 works fine. Pretty much everything runs on VMs, on intel NICs. As IPv6 is not vital and that I do not see any easy way to get this sorted I might not invest too much effort in getting this working. In any case, I will report my findings here
In any case, thank everyone for the help.
-
Yep this is strange. I did some more testing, and I am also getting weird errors when I set router advertisement to 1280 (but traffic works, beside wireshark, everything is green)
I am unsure about bad hardware, as ipv4 works fine. Pretty much everything runs on VMs, on intel NICs. As IPv6 is not vital and that I do not see any easy way to get this sorted I might not invest too much effort in getting this working. In any case, I will report my findings here
In any case, thank everyone for the help.
You never mentioned if this effects any other site. Other then that one.
-
I am unsure about bad hardware, as ipv4 works fine.
If you're getting CRC errors, you have a hardware problem that has nothing to do with IP or web site. It could be a bad NIC, switch port, cable connection, etc., but something physical is causing that. Are you certain you don't see any similar errors with IPv4? You can try pinging with different size packets to test and you can also force either IPv4 or IPv6 when testing. Do you get similar errors if you use a different computer?
-
I know it old topic, but @JKnott test yourself https://meet.lync.com/ not adjusted at all
-
@dragoangel said in Changing AdvLinkMTU when using NPt:
I know it old topic, but @JKnott test yourself https://meet.lync.com/ not adjusted at all
What am I supposed to be looking for? All I see is an error message about not being allowed to enter the meeting. Wireshark doesn't show anything unusual either. I don't see any frame errors, as was described in the previous messages.
-
I'm alredy found answer on my question in https://answers.microsoft.com/en-us/msoffice/forum/msoffice_sfb-mso_mac-mso_o365b/skype-for-businesslync-services-dont-appear-to/c204b511-8b0b-4338-924e-729603627413?page=2 sorry =).
-
@dragoangel said in Changing AdvLinkMTU when using NPt:
I'm alredy found answer on my question
Tunnels always have a smaller MTU than the underlying network, to make room for their own header. I wouldn't experience that problem here, as I'm not using a tunnel. My MTU, on both sides of pfSense, is 1500.
I used to use a tunnel, with 1280 MTU.
It would appear the problem is with Microsoft software (Gee... What a surprise!!! ) not properly handling PMTUD. By reducing the local MTU, packets are no longer too big to pass through a link with the smaller MTU.
-
@JKnott Yes, I read it. They not go by RFC. And this is not first time I see it. I write them about HTTP/2 in IIS =). Same here... Lower down all LAN MTU only for some 2-3 host in Internet. Better rewrite DNS...
P.S. If configure MTU on GIF to tunnelbroker - this is ok. It really 1480. And configure Squid Proxy. PC by proxy will access lync.com. This acceptable workaround #2. But without proxy - of course with brokem PMTU on MS side it anyway fail
