-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 01/11/14 03:24, Mick wrote: > On Friday 10 Jan 2014 19:42:37 Kerin Millar wrote: >> the wrote: >>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 >>> >>> Hello. This is the the first time I'm dealing with wifi and the >>> second time with NAT. I have a server (access point) with a >>> ppp0 interface (internet), eth0, wlan0, tun0 and sit0. A dhcp >>> server is listening on wlan0 and provides local ip addresses, >>> dns (= my isp dns) and router (= server wlan0 ip address). Nat >>> is configured on the server like this: # Generated by >>> iptables-save v1.4.20 on Fri Jan 10 21:34:26 2014 *raw >>> >>> :PREROUTING ACCEPT [1000941:974106726] :OUTPUT ACCEPT >>> [775261:165606146] >>> >>> COMMIT # Completed on Fri Jan 10 21:34:26 2014 # Generated by >>> iptables-save v1.4.20 on Fri Jan 10 21:34:26 2014 *nat >>> >>> :PREROUTING ACCEPT [888:45008] :INPUT ACCEPT [63:9590] :OUTPUT >>> ACCEPT [442:27137] :POSTROUTING ACCEPT [36:1728] >>> >>> - -A POSTROUTING -o ppp0 -j MASQUERADE COMMIT # Completed on >>> Fri Jan 10 21:34:26 2014 # Generated by iptables-save v1.4.20 >>> on Fri Jan 10 21:34:26 2014 *mangle >>> >>> :PREROUTING ACCEPT [1000941:974106726] :INPUT ACCEPT >>> [951658:947497602] :FORWARD ACCEPT [39262:26279024] :OUTPUT >>> ACCEPT [775261:165606146] :POSTROUTING ACCEPT >>> [814621:191890787] >>> >>> COMMIT # Completed on Fri Jan 10 21:34:26 2014 # Generated by >>> iptables-save v1.4.20 on Fri Jan 10 21:34:26 2014 *filter >>> >>> :INPUT ACCEPT [371:35432] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT >>> [33994:3725352] >>> >>> - -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT - -A >>> FORWARD -i wlan0 -o ppp0 -j ACCEPT - -A FORWARD -i ppp0 -o >>> wlan0 -j ACCEPT - -A FORWARD -i eth0 -j DROP - -A FORWARD -i >>> tun0 -j DROP COMMIT # Completed on Fri Jan 10 21:34:26 2014 I >>> have a client that connects to my wifi, obtains an address via >>> dhcp and ... can't acces almost all of internet sites. I was >>> able to ping any web service I could think of, but I was able >>> to use only google/youtube. I can do text/ image serches on >>> google and can open youtube(but videos aren't loading). On >>> other services wget says connection established, but it can't >>> retrieve anything. if I ssh to an external server (not my nat >>> server) I can ls, but if I try to ls - -alh I receive only a >>> half of the files list and the terminal hangs after that. If I >>> do $python -m http.server on my server I can do file transfers >>> and open html pages on my client. I have tried this >>> https://wiki.archlinux.org/index.php/Software_Access_Point#WLAN_is_very_s >>> >>> low >>> >>> Also I have tried to insert LOG target in FORWARD of filter. It >>> showed that I send way more pakets(>10) to a http server than >>> I receive(~2-4). The client is fine and behaves normally with >>> wifi, used it many times. Thanks for your time. >> >> It's probable that you need to make use of MSS clamping. Try the >> following rule: >> >> iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN >> -j TCPMSS --clamp-mss-to-pmtu >> >> --Kerin > > This explains it: > > http://lartc.org/howto/lartc.cookbook.mtu-mss.html > > Is there a router somewhere (your ISP?) that does not play nice > with PMTU Discovery? What happens if you set your ifaces to have > an mtu or 1492 (needed to accomodate your PPPoE headers) or even > lower like 1440, or 1380?
Thanks you Kerin, Mick! It works like a charm. Indeed: ppp0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1492 So do I understand correctly that field of size 1500 - 1492 is reserved for pppoe stuff? Will it also work if I set a smaller mtu in my wlan like 1400 (assuming that the smallest mtu on the path is not less than 1400)? -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJS0QWKAAoJEK64IL1uI2haA1sIAJNWQMRy237bStiLQcxzLzc4 8wWjQUt2wf3tHokTCIRLYuPClYiWg1yKnB7Nh1/SKZ3kpN6cGSvKG0qmWmz2g78W nrPZ/7QrADmBA00n3Zem8HGR4im+Uo83AWYNKwrr6SfBr2Ju1hjEDXSspTkZcLPp 22lNK0OaA/lRBusdc/2lg7ALK3YwInGSvlq95eLK6V86ADzcardu1+nn5erv1JJW 4OzgaQITe4dKREoeqHEyAJEdxh2xCKP9f7aaTulvS0WccD3ws1jd1b2w1Fjb6tYI Ez068tGhc+GdTlGRbpG5rGqviEYfUuvHIyfAc8/PBAx9nSHYISJEom88VQN7Mqc= =op4W -----END PGP SIGNATURE-----
