OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • Archive »
  • 17.1 Legacy Series »
  • Fragmented UPD not send over IPSEC tunnel
« previous next »
  • Print
Pages: [1]

Author Topic: Fragmented UPD not send over IPSEC tunnel  (Read 6748 times)

jaco.vandenberg

  • Newbie
  • *
  • Posts: 8
  • Karma: 0
    • View Profile
Fragmented UPD not send over IPSEC tunnel
« on: June 26, 2017, 05:17:17 pm »
Hi,

we are running IPSEC to a connect a site to a Fortigate firewall in the datacenter using a site-to-site VPN.
This works fine for normal  client traffic (mostly RDP over TCP) .
It turns out however, that Fragmented UPD is not send from the Fortigate site to the opnsense site .

This used to worked fine when the opnsense was a m0n0wall firewall, , however as soon as ik bring down the m0n0wall and lanuch the opnsense, it stops working. Switching back to the M0n0Wall it works fine again, so it muist be a opsense thing, blocking fragmented UDP for some reason.

opnsense is the latest version.

Any ideas what's wrong ?
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 6348
  • Karma: 437
    • View Profile
Re: Fragmented UPD not send over IPSEC tunnel
« Reply #1 on: June 26, 2017, 06:52:55 pm »
Firewall / Settings / Normalization

Tick IP Do-Not-Fragment and recheck.
Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

jaco.vandenberg

  • Newbie
  • *
  • Posts: 8
  • Karma: 0
    • View Profile
Re: Fragmented UPD not send over IPSEC tunnel
« Reply #2 on: June 26, 2017, 08:56:30 pm »
Excellent !

I tried that, your suggestion did not work at first sight, however, in this menu:

Firewall: Settings: Normalization : Detailed Settings, i added a line for the IPsec tunnel with the "IP Do-Not-Fragment" setting. That improved things quite a bit !

Now it allows most packets through the tunnel . However a certain packet loss is observed when tested with iPerf.

So upstream there is no UDP packet loss (there never was), downstream there is about 20% packet loss.
When the do-not-fragment setting ïs disabled, all packets are dropped, so it DOES have positive effect on the problem, however, quite some packets still get lost. 

That is strange, isn't it ?
« Last Edit: June 26, 2017, 08:59:43 pm by jaco.vandenberg »
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 6348
  • Karma: 437
    • View Profile
Re: Fragmented UPD not send over IPSEC tunnel
« Reply #3 on: June 26, 2017, 10:14:45 pm »
Yep, but normally you should fix the fragmentation issue if possible, this would be best practice.
Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

bartjsmit

  • Hero Member
  • *****
  • Posts: 1604
  • Karma: 167
    • View Profile
Re: Fragmented UPD not send over IPSEC tunnel
« Reply #4 on: June 26, 2017, 11:28:51 pm »
Do you have the same MTU all along the path?

Bart...
Logged

jaco.vandenberg

  • Newbie
  • *
  • Posts: 8
  • Karma: 0
    • View Profile
Re: Fragmented UPD not send over IPSEC tunnel
« Reply #5 on: June 27, 2017, 11:39:03 am »
did not check that, however TCP is flowing perfectly and the problem stays with very small MTU sizes (i.e. 400).
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 6348
  • Karma: 437
    • View Profile
Re: Fragmented UPD not send over IPSEC tunnel
« Reply #6 on: June 27, 2017, 11:44:27 am »
When the problem stays with small MTU too your hardware is underpowered.

I also experienced issues when testing with IPerf some ASA 5515 routers, when it reaches the limit packets get dropped.
Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

IJH

  • Newbie
  • *
  • Posts: 1
  • Karma: 0
    • View Profile
Re: Fragmented UPD not send over IPSEC tunnel
« Reply #7 on: June 28, 2017, 12:40:39 pm »
Have you modified the MTU on the Fortigate policy?

you can modify it per policy:

config firewall policy
edit xxx
set tcp-mss-sender 1436

You'll need to calculate the MSS and edit the 1436 number depending on what you're connected by on the interface the Fortigate is using for the IPSec tunnel.
Logged

mimugmail

  • Hero Member
  • *****
  • Posts: 6348
  • Karma: 437
    • View Profile
Re: Fragmented UPD not send over IPSEC tunnel
« Reply #8 on: June 28, 2017, 12:45:35 pm »
MSS is for TCP, the problem here are UDP packets
Logged
Twitter: mimu_muc
WWW: www.routerperformance.net
Support plans: https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German): https://opnsense.max-it.de/

  • Print
Pages: [1]
« previous next »
  • OPNsense Forum »
  • Archive »
  • 17.1 Legacy Series »
  • Fragmented UPD not send over IPSEC tunnel
 

OPNsense is an OSS project © Deciso B.V. 2015 - 2023 All rights reserved
  • SMF 2.0.19 | SMF © 2021, Simple Machines
    Privacy Policy
    | XHTML | RSS | WAP2