Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    2.0.1 enable PMTUD upstream tunnel - yahoo sites not working

    Scheduled Pinned Locked Moved General pfSense Questions
    1 Posts 1 Posters 1.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      stompro
      last edited by

      Hello, I'm running 2.0.1 on an Alix.  Recently the site that I'm having trouble with switched to a new connection.  The ISP is subcontracting the connection to a local cable company, and using a cisco router directly upstream of the firewall to tunnel the traffic back to the ISP's network.  So I'm running into MTU problems.

      The main symptom is that I'm unable to connect to any yahoo websites, www.yahoo.com, news.yahoo.com, flickr.com.  Packet captures show that the http connection is made, the browser requests the page and then the remote server never sends back data.  So the remote server isn't figuring out that they need to lower the MTU, so their packet never gets through.

      The ISP was able to fix the problem by setting the PMTU on their end, but says that they would rather I have our pfsense firewall setup to do PMTUD and then said I was blocking ICMP too aggressively.

      So I added a wan rule to allow ICMP type 3 packets, which I can see are being sent to the firewall.  But does the firewall actually do anything with those?  What do I need to do to enable PMTUD.  The set their PMTU back to auto and I tested and I see the ICMP's being sent saying need to fragment, but the sites still don't work.

      Also, since it is the yahoo server that is sending a packet that is too large, isn't the problem that they are not getting the icmp packet telling them to send a smaller packet?

      I also tried changing the WAN MTU and MSS to 1300, which didn't have any effect that I could see.  Is there some trick to getting that to work, or because the PMTUD isn't working, maybe the MTU change isn't getting discovered.

      The tunnel MTU seems to be 1460 from looking at packet captures when the ISP made their fix.

      I'm using pfsense in Nat mode.
      Thanks
      Josh

      Hardware used: Alix 2D13 X 10, APU2D4 X 10, SG-2200 X 10, SG-2440 X 4

      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.