Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Which Correct MTU/MSS configuration

    Scheduled Pinned Locked Moved IPsec
    3 Posts 1 Posters 3.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      raphr
      last edited by

      HI community, we have implemented  13 Site to site Ipsec VPN tunnels with pfsense 2.3.1_2 with a SG8600 and small alix boxes on remote sites. Some tunnels have up to 3 Phase 2 subnetworks.

      It works in general but we have problems with MTU size with pppoe DSL connections with Nat-T.
      Gateway interface is set to 1454 MTU.

      by testing ping packet size througth the tunnels, it doesn't work over 1394 MTU. I've then put 1390 In MSS IPsec settings.
      This works better, but we still have troubles with packet size between 1394 an 1473 which drops into black hole. packaet size above 1473 are correctly frgamented.

      In consequence, we have many connections hangs randomly with htt, https, ssh,…

      What is then the best settings I should have ? should I change IPSec MTU's Interface ?
      Is setting MTU/MSS remote site is alsao needed ?

      thank you.

      1 Reply Last reply Reply Quote 0
      • R
        raphr
        last edited by

        By seeking, this seems a problem similar to https://forum.pfsense.org/index.php?topic=87814.msg483118#msg483118.

        Something in the modem router is blocking fragmented packet. This is SDSL tG605s
        I'll ask hekp to ISP.

        1 Reply Last reply Reply Quote 0
        • R
          raphr
          last edited by

          By looking further, IPsec is generally not working well with NAT-T. I have many traffic drops.
          neither with multiple Phase2, Even if status shows tunnels online.
          Rebooting make tunnels work again for some time.

          I have changed NAT-T Tunnels with OpenVPN as i'm 100% pfsense on remote sites. Since it works much better.
          I have just trouble when rebooting server. I'll make a topic.

          Regards

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.