How to set MSS using netgraph

scotia

scotia

Hi all,

Is there a way to turn or MSS clamping on an interface using just netgraph? Or must one use a firewall or some other diverting code as well!

I’ve read the ng_tcpmss man page but I’m too dim to figure it out.

Thanks
 
What is your setup and where do you want to introduce ng_tcpmss? What have you tried that did not work? I haven't used this node type before but I will take a look at it once you've shared your desired setup.
 
Hi, thanks for the offer of help.

I have a few VMs in cloud land that I connect to my central router via IPSEC whose ipsec0 interface has an MTU of 1400. My CSP allows backdoor links between VMs, and those are on vtnet interfaces with an MTU of 1500. While playing around with some dynamic routing I was in a situation where I had asymmetric paths. Traffic to the VM would arrive on the ipsec0 interface and return across the backdoor link via another VM (or vice versa). Aside from needing to fix my routing, large (>1400 bytes) packets were being dropped, so things like SSH would stall, pings of ~1450bytes with DF-bit set would not succeed, etc.

Yes, I need to fix my routing, but it also occured to me that I could solve the large TCP packet issue by munging the MSS in the three way handshake. And hence I started looking at ng_tcmss. Which as I said I could not translate the man page to even begin building a configuration. On my head-end router (a Cisco) it's trivial to enable MSS adjusting; I was hoping the same on FreeBSD.

Thanks
 
So if I understand this correctly, you have, for example, three virtual private servers running somewhere on the Internet. They all have two interfaces with vtnet0 connecting to the Internet and vtnet1 connecting them to each other over a private network provided by your service provider. You also have a central router on-premise from where you build three (in this exampel) IPsec tunnels, one to each VPS. These virtual interfaces are called ipsec0.

This means that every server has three interfaces:
  1. vtnet0 with an unknown MTU but you assume it is high enough;
  2. vtnet1 with an MTU of 1500; and
  3. ipsec0 with an MTU of 1400.
You communicate with the virtual private servers on the private IP address of their ipsec0 interface but somehow return traffic sometimes finds it way over the internal network connecting over vtnet1. This causes the MTU of the packets to be higher?

Why not configure the ipsec0 interface with an MTU of 1400 and the vtnet1 interface also with an MTU of 1400? I don't understand how you would fit ng_tcpmss in this setup. The way I see it, if you have a virtual ng_eiface interface, e.g. for a jail, then you can connect that to an ng_tcpmss node to control MSS (though you can also configure it directly on the ng_eiface interface), and then pass it on to an ng_bridge or something.
 
Thanks for reply. What I'd really like to figure out is how to use ng_tcpmss to modify the MSS of passing SYN and/or SYN-ACK packets. On a simple interface (no jails). Does ng_tcpmss need ng_eiface?
 
You must log in or register to reply here.
Back
Top