Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    MTU/MSSFIX

    Scheduled Pinned Locked Moved
    OpenVPN
    6
    16
    16.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      rustydusty1717
      last edited by

      Well I've got it much more stable without the disconnects.

      Currently:

      IPFastforwarding changed to 1
      Server - fragment 1400
      Client - fragment 1400;mssfix 1400

      Only settings that have got me anywhere. I can pull files from colocate to site now at atleast 5Mb/s and ping times staying somewhat stable.

      Also tried this:

      ping -f -l 1472 172.16.0.1 - works
      ping -f -l 1473 172.16.0.1 - fails

      1 Reply Last reply Reply Quote 0
      • P
        phil.davis
        last edited by

        This has some information about what I found on my systems last year: https://forum.pfsense.org/index.php?topic=67080.0

        The 1472 thing is because there is 28 bytes of OpenVPN plus ICMP packet overhead and that makes 1500 total, which fits through the tunnel. 1473+28=1501 and does not fit.
        I have messed about trying to find a fix for that with no joy.
        You can do:

        ping -f -l 1473
Pinging 10.49.32.1 with 1473 bytes of data:
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.

Ping statistics for 10.49.32.1:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

        That explicitly sets the "do not fragment" bit, which gets you a proper message back about what happened.

        That implies that OpenVPN knows to fragment that packet across the tunnel. It should do it, and the data should stgill get through. But maybe the receiver (I have tried to a Windows Server and to the pfSense LAN IP at the other end) does not cope with re-assembling ICMP packets?

        As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
        If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

        1 Reply Last reply Reply Quote 0
        • R
          rustydusty1717
          last edited by

          Ultimately I'm looking for what parameters for MTU, fragment and mssfix I need on both client and server side to get this to work the best.

          Client/Server are currently:

          tun-mtu 1472;fragment 1400;mssfix

          1 Reply Last reply Reply Quote 0
          • R
            rustydusty1717
            last edited by

            Anyone got any idea or any more info I can provide? It would be a Christmas miracle if this could be figured out

            1 Reply Last reply Reply Quote 0
            • C
              cmb
              last edited by

              @rustydusty1717:

              Anyone got any idea or any more info I can provide?

              answer my last post's questions.

              1 Reply Last reply Reply Quote 0
              • R
                rustydusty1717
                last edited by

                @cmb:

                @rustydusty1717:

                Anyone got any idea or any more info I can provide?

                answer my last post's questions.

                Apologies.

                using UDP and the vpn is no longer dropping using these settings:

                Server - tun-mtu 1472;fragment 1400;mssfix
                Client - tun-mtu 1472;fragment 1400;mssfix

                Still only getting about 5Mbps over SMB transfer. No limits, client side has 25Mb download speed connection, server is on a 50Mb upload speed connection. I should be getting much better transfer speeds. I can transfer documents over other sites that are colocated at the same data center at 12Mbps+

                Only difference being that this client is using an Alix to run the pfsense. Load averages on it aren't high when doing transfers, though. My settings seem to be bottle necking it.

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  Don't look at load averages.  Look at CPU use percentage.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • R
                    rustydusty1717
                    last edited by

                    650-700KB/s - 10-50% CPU usage

                    1 Reply Last reply Reply Quote 0
                    • C
                      cmb
                      last edited by

                      SMB performs horribly over higher latency connections. Compare to HTTP or some other means of transfer that isn't SMB (iperf, FTP, pretty much anything other than SMB).

                      1 Reply Last reply Reply Quote 0
                      • T
                        Techneau @rustydusty1717
                        last edited by

                        @rustydusty1717 I know this is an old post but how do i perform these chances to the MTU/MSSFIX. There is no clear instructions on how to perform any of this.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post