[deleted]
hi
I have multiple questions but the more important is the first one.
roadwarrior clients A <-> server A <-> ipsec tunnel(TCPMSS=1374) <-> server B <-> roadwarrior clients B
| |
LAN A (192.168.100.0/24) LAN B (192.168.200.0/24)
1. I have 2 server which run openvpn in server mode(one port tcp,and the other udp, both with comp-lzo setup) both and listen to roadwarrior clients.
In this servers I have ipsec tunnel setup which works very well. The max tunnel data send over ipsec tunnel tested with ping with "dont fragment" is 1386 so the max payload is 1414. I have setup in both server 2 rules in firewall to TCPMSS 1374 (1414-20[ip overhead]-20[tcp overhead])
The tun-mtu is default 1500 on openvpn and link-mtu is derived from to 1558. In the config file I don't use fragment and the mss-fix is setup to default value 1450.
I want to know how to tunning this 2 setups with "fragment,tun-mtu,link-mtu,mss-fix,mtu-test"?
2. Please help me to understand this directives if were correct
a. link-mtu = mtu-tun + openvpn overhead encryption
b. tun-mtu = maximum payload minus openvpn encryption that can be send over wire
c. mtu-test = i don't understand the output of this directive
NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[1445,1445] remote->local=[1557,1397]
NOTE: This connection is unable to accomodate a UDP packet size of 1445. Consider using --fragment or --mssfix options as a workaround.
d. fragment = the maximum payload in port udp mode used, this value is in my case 1414-20-20 =1374 (is corect?)
e. mss-fix = the maximum payload of tcp data send over tunnel minus tcp overhead ; in my case is 1374?
Please corect me if I understand bad this directive and help me to tuning this setup like ipsec tunnel for maximum performance client-server.
