Messages

KVM "hardware" (vtnet1) can do 1512 MTU?

That was the issue. VM network device (virtio) actually forces MTU 1500 on Proxmox by default. From Proxmox documentation:

You can overwrite the MTU setting for each VM network device. The option mtu=1 represents a special case, in which the MTU value will be inherited from the underlying bridge. This option is only available for VirtIO network devices.

My Linux bridge (and underline hardware NIC) set to MTU 1512, so virtio device at Proxmox side now have the same configured.

Code Select Expand

vtnet1: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1512
        options=80008<VLAN_MTU,LINKSTATE>
        ether bc:24:xx:xx:xx:xx
        media: Ethernet autoselect (10Gbase-T <full-duplex>)
        status: active
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
vlan01.6: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1508
        options=80000<LINKSTATE>
        ether bc:24:xx:xx:xx:xx
        groups: vlan
        vlan: 6 vlanproto: 802.1q vlanpcp: 0 parent interface: vtnet1
        media: Ethernet autoselect (10Gbase-T <full-duplex>)
        status: active
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
pppoe0: flags=10088d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        description: WAN (wan)
        options=0
        inet XX.XX.XX.XX--> YY.YY.YY.Y netmask 0xffffffff
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

And this finally works as expected. I updated my initial message.

This obviously works:

Code Select Expand

vtnet1: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        options=80028<VLAN_MTU,JUMBO_MTU,LINKSTATE>
        ether bc:24:xx:xx:xx:xx
        media: Ethernet autoselect (10Gbase-T <full-duplex>)
        status: active
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
vlan01.6: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        options=80000<LINKSTATE>
        ether bc:24:xx:xx:xx:xx
        groups: vlan
        vlan: 6 vlanproto: 802.1q vlanpcp: 0 parent interface: vtnet1
        media: Ethernet autoselect (10Gbase-T <full-duplex>)
        status: active
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
pppoe0: flags=10088d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1492
        description: WAN (wan)
        options=0
        inet XX.XX.XX.XX--> YY.YY.YY.YY netmask 0xffffffff
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

Not very clear why vtnet1 and vlan01.6 have the same MTU

This does not work:

Code Select Expand

vtnet1: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1512
        options=80028<VLAN_MTU,JUMBO_MTU,LINKSTATE>
        ether bc:24:xx:xx:xx:xx
        media: Ethernet autoselect (10Gbase-T <full-duplex>)
        status: active
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
vlan01.6: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1508
        options=80000<LINKSTATE>
        ether bc:24:xx:xx:xx:xx
        groups: vlan
        vlan: 6 vlanproto: 802.1q vlanpcp: 0 parent interface: vtnet1
        media: Ethernet autoselect (10Gbase-T <full-duplex>)
        status: active
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
pppoe0: flags=10088d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        description: WAN (wan)
        options=0
        inet XX.XX.XX.XX--> YY.YY.YY.YY netmask 0xffffffff
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>


Sounds logical, but I can't confirm proposed configuration actually works in current version of Opnsense (25.1.1). I can confirm, the resolution is down the line.
My setup is PPPoE over VLAN, provider (KPN NL) declares that MTU 1500 on PPPoE is supported.
I run Opnsense in a Proxmox VM with bridge for WAN (bridge and it outbound physical interface in Proxmox set to MTU 1512).
The suggested configuration lead to a broken internet connection, DNS (Unbound with DoT) barely resolve anything.

I'll assume that you didn't specify the DNS server addresses at SYSTEM: SETTINGS: GENERAL ->Networking

But this is the case when DNS-over-TLS is used, isn't it?
So it means Haproxy + Unbound DoT is not compatible setup?