IPSec transport mode, mtu, fragmentation...

[Victor Sudakov]

Kajetan Staszkiewicz wrote:
> On 20.12.19 16:23, Victor Sudakov wrote:
> > Dear Colleagues,
> > 
> > I've set up IPSec in transport mode between two regular FreeBSD hosts,
> > for testing. Now TCP sessions between those hosts don't work normally
> > any more. For example, scp is stalled almost immediately after starting
> > a file transfer, and so is interactive ssh eventually.
> > 
> > I feel that the problem is somehow related to MTU, MSS and fragmentation
> > of ESP packets, because:
> > 
> > 1. When IPSec is disabled, I can "ping -s1472 -D" the remote host all
> > right. 
> > 
> > 2. When IPSec is enabled, the maximum packet size I've been able to send
> > through is "ping -s1414 -D". ("ping -s1415 -D host-b" already disappears
> > in the void).
> > 
> > I'm really at a loss what to do about that. In transport mode, there is
> > no network interface I could adjust MTU on, or run some kind of MSS
> > fixer.
> 
> Maybe you could add route to the remote host with -mtu parameter. 

Just tried "route add -host host-b -mtu 1400 gw". The route is there
with the right mtu (according to "route get host-b") but it did not
help. Probably the packet is intercepted by IPsec before it gets into
routing.

What gives? Setting up IPsec transport mode between hosts should be a
simple thing which *just* *works*.

What's the root of the problem? ESP packets cannot get fragmented or
what? 

> I've
> never tested this because I have interfaces (either if_ipsec of if_gif
> protected with transport mode IPSec) and I do mss clamping in pf, but
> this could work.

My goal being the creation of an IPSec protected network between several
hosts (running on X.509 certificates to enable automatic traffic
protection), configuring tunnels or additional interfaces on each host
would be unfeasible.


-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
2:5005/49 at fidonet http://vas.tomsk.ru/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 455 bytes
Desc: not available
URL: <http://lists.freebsd.org/pipermail/freebsd-net/attachments/20191220/6420adee/attachment.sig>