Hi,
I am using Openswan to configure an IPSec VPN (using the xfrm/netkey
backend). Large HTTP POST requests from the client seem to get stuck,
because the outgoing packets are 1530 bytes (before being wrapped into
ESP packets). The problem goes away by setting sysctl
net.ipv4.ip_no_pmtu_disc=1.
May have something to do with it:
The tunneled network is 10.6.6.6/32 and I am SNAT'ing some destinations
to that IP, so they get routed through the tunnel. Any other networks
are not to go through the tunnel.
iptables -t nat -A POSTROUTING -d "${R}" -j SNAT --to-source 10.6.6.6
It seems quite clear to me that xfrm is doing something wrong here.
Ortwin
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
