On 06.08.2023 10:30, D. Hugh Redelmeier wrote:
I'm having trouble getting a gateway/router working.
Context:
- I have two gateways, both to broadband, both requiring PPPoE
- both are running Fedora 38 and use firewalld-1.3.1-1.fc38.noarch
- one works and one doesn't work reliably: some web sites time out
I think that the problem is with MTU. PPPoE doesn't allow 1500 byte packets through: the limit is 1492.
The "proof" is that if I set the MTU to 1492 on a client's ethernet interface, the client can use the bad gateway with no problem.
firewalld.policy(5) says that there is an option:
tcp-mss-clamp Is an optional empty-element tag and can be used several times. If left empty maximum segment size is set to 'pmtu'. This tag has exactly one optional attribute:
value="string" Value can set maximum segment size to 'pmtu' (Path Maximum Transmission Unit) or a user-defined value that is greater than or equal to 536.I took this as meaning that I could add <tcp-mss-clamp/> to the policy file, like this:
<?xml version="1.0" encoding="utf-8"?>
<policy priority="100" target="ACCEPT"> <ingress-zone name="FedoraServer"/> <egress-zone name="external"/> <tcp-mss-clamp/> </policy>
It sounds like the documentation bug. For all I can tell, tcp-mss-clamp can only be used in rich rules and all firewalld regression tests also use it only in rich rules.