Problem with net.inet.tcp.path_mtu_discovery=1

CyberCr33p

CyberCr33p

I manage some servers hosting websites.

Using the APN vpn-internet on a 5G router, I receive a public IP address from the range 149.210.xxx.xxx, but I notice that some websites do not load.

The same problem has been reported by other users who also receive an IP from the same range (149.210.xxx.xxx).

In contrast, when I connect using the APN internet and get an IP from the range 5.203.136.xxx, all websites load normally.

Eventually, I found that the issue is related to Path MTU Discovery.

When the net.inet.tcp.path_mtu_discovery setting is enabled on the operating system, the problem occurs. If I disable it, then the problem goes away. This setting had been enabled for years on my servers, so something must have changed recently with my ISP's apn vpn-internet.

Also enabling net.inet.tcp.pmtud_blackhole_detection didn't help.

Does anyone know if PMTUD blackhole detection is broken in FreeBSD?
 
First, I reverted the server settings to their defaults:

sysctl net.inet.tcp.path_mtu_discovery=1
sysctl net.inet.tcp.pmtud_blackhole_detection=0

Next, I set the MTU on my local computer to 1460 and everything worked as expected.

However, when I set my local computer’s MTU back to 1500 (the default), the issue reappeared.
 
Cloudflare had a really useful test for this stuff, but sadly the service went down earlier this year, and I havent seen anything else that does the same thing.
 
Since I was the one who reported the problem, it was eventually resolved after some time, as the issue turned out to be related to my ISP.
 
PMTU discovery can be broken if you, or something along the network path, drops all ICMP. we have these PF rules on our openbsd border firewall, you might have to adapt these for freebsd PF.
Code: 
pass in inet proto icmp icmp-type {timex, paramprob} max-pkt-rate 128/8
pass inet proto icmp icmp-type unreach
 
You must log in or register to reply here.
Back
Top