IPSec transport mode, mtu, fragmentation...
vas at sibptus.ru
Mon Dec 23 10:07:04 UTC 2019
Andrey V. Elsukov wrote:
> On 20.12.2019 19:22, Victor Sudakov wrote:
> >> What's the root of the problem? ESP packets cannot get fragmented or
> >> what?
> > Wireshark has shown that the "Don't Fragment" flag is set on all ESP
> > (protocol 50) packets. Who does this, why, and how can I switch it off
> > globally?
> I think this DF flag is originally from TCP packet.
You are probably right. I did not think of this.
> ESP xform for transport mode just replaces protocol in IP header and
> adds some info to the end of a packet.
It is rather easy to verify your theory. If you are right, then
disabling net.inet.tcp.path_mtu_discovery globally should remove the DF
flags from the ESP packets too, right?
Of course, net.inet.tcp.path_mtu_discovery=0 is not a solution, it's just
a way to check the origin of the DF flag.
And if you are right, what does it mean to us? Did you see
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=242744 already ?
My ultimate wish is to make transport mode work out of the box, without
any workarounds like additional host routes or firewall rules.
Victor Sudakov, VAS4-RIPE, VAS47-RIPN
2:5005/49 at fidonet http://vas.tomsk.ru/
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 455 bytes
Desc: not available
More information about the freebsd-net