Strange MTU Issue with OpenVPN Server and gl-inet Client

Need help configuring your VPN? Just post here and you'll get that help.

Moderators: TinCanTech, TinCanTech, TinCanTech, TinCanTech, TinCanTech, TinCanTech

Forum rules
Please use the [oconf] BB tag for openvpn Configurations. See viewtopic.php?f=30&t=21589 for an example.
Post Reply
amercat37
OpenVpn Newbie
Posts: 1
Joined: Wed Dec 06, 2023 8:54 pm

Strange MTU Issue with OpenVPN Server and gl-inet Client

Post by amercat37 » Wed Dec 06, 2023 9:11 pm

I have an OpenVPN server setup up at my home and a gl-inet Berly AX client setup.

If I ping through the tunnel, I get the following results:
ping -f www.yahoo.com -l 1472
Reply from 69.147.92.11: bytes=1472 time=83ms TTL=55

ping -f www.yahoo.com -l 1473
Packet needs to be fragmented but DF set.

This would lead me to believe that my mtu should be set to 1500. 1500 - tcpheader20 - icmpheader8 = 1472

My tunnel server and client config both have tun-mtu set to 1500 and mssfix set to 1450. I could probably set it to 1460, but 1450 works great for me.

My issue is that when I establish a TCP session, openvpn is adjusting the mss to 1254, even though I have it set to 1450. I checked all of my interface mtu settings and iptables for any strange mtu or mss settings, but everything is great. Any help would be appreciated. I have done captures on all devices inbetween my pc and the server, and the mss is definitely getting changed by this tunnel. I could probably just do some mss clamping in iptables to the outside interfaces on the client and server, but I would rather figure out the problem.

Server Config:
[oconf=]port 1194
proto udp
dev tun
ca ca.crt
cert wg0.crt
key wg0.key # This file should be kept secret
dh none
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
tls-crypt ta.key
cipher AES-256-GCM
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
verb 3
explicit-exit-notify 1
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
mtu-test

Client Config:
[oconf=]client
dev tun
proto udp
remote my.server.com port
resolv-retry infinite
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ping 15
ping-restart 0
ping-timer-rem
reneg-sec 0
fast-io
persist-key
persist-tun
key-direction 1
remote-cert-tls server
cipher AES-256-GCM
auth SHA256
verb 3

Post Reply