This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

PPTP/PPPoA and Policy Routing, MTU issue?

I have a NIC set as a PPPoA/PPTP tunnel that connect to a PPTP VPN at my ISP (only way to get static IP from them). The MTU on it is 1500, also my WAN is Cable with MTU = 1500
The VPN "works".

To test it out I have setup a Policy Route such as:

Type: Interface route
Source network: my laptop host
Services: Any
Destination network: Internet
Target Interface: PPPoA VPN Interface

This work pretty well for ping, internet download etc, however I noticed two things:

1) Some website partially load or load forever, wireshark show a HTTP GET then a ACK back and nothing else.

2) I sometime see the message: "ICMP Fragmentation Needed"

Any ideas?

Thanks!

This thread was automatically locked due to age.

Parents

0 BAlfson over 13 years ago

Isn't that done to set the MTU to a lower value? Why didn't that work from the 'Advanced' section of the PPPoA/PPTP 'Interface' definition?

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 x-cimo over 13 years ago in reply to BAlfson

Wow! I'm happy I can maybe make you learn something today, here is what I understood from it.

MTU Path discovery dosen't work that well, for many reason apparently.

Another way to archive similar result is by teaching iptables to modify the advertised Maximum Segment Size at the TCP layer (so a TCP packet dosen't exceed "X"),

TCP MSS: The TCP/IP Guide - TCP Maximum Segment Size (MSS) and Relationship to IP Datagram Size

Basically by limiting the MSS at TCP, it limit the size at the IP layer (MTU).

This is what the iptables rule above does..

And I seem to have found the proper place to implement this in a different thread:

https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/t/39700
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 x-cimo over 13 years ago in reply to BAlfson

Wow! I'm happy I can maybe make you learn something today, here is what I understood from it.

MTU Path discovery dosen't work that well, for many reason apparently.

Another way to archive similar result is by teaching iptables to modify the advertised Maximum Segment Size at the TCP layer (so a TCP packet dosen't exceed "X"),

TCP MSS: The TCP/IP Guide - TCP Maximum Segment Size (MSS) and Relationship to IP Datagram Size

Basically by limiting the MSS at TCP, it limit the size at the IP layer (MTU).

This is what the iptables rule above does..

And I seem to have found the proper place to implement this in a different thread:

https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/t/39700
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data