Fragment Directive

plays88keys

I'm getting an error that fragment directive is not supported. Any ideas?

lolex

plays88keys wroteI'm getting an error that fragment directive is not supported. Any ideas?

Taken from the OpenVPN Connect iOS FAQ:
"The fragment directive is not supported due to the complexity it adds to the OpenVPN implementation and the fact that it is usually better to leave fragmentation up to the lower-level transport protocols. Note as well that the client dies not support connecting to a server that uses the fragment directive."

However I believe that this option is one of the most important directives, complex or not. It resolves problems in many situations that cannot be resolved otherwise or only with a lot more effort. For example some of our employees have SoHo routers at home that crash when receiving a lot of large UDP packets. Simply add "--fragment 1460" and everyone is happy again.

redradioflyer

I agree, I'd like to see support for the fragmentation directive in the iOS app. In addition to the problem mentioned it can also be used to lighten the app's workload (as I understand it... and I don't... so if I'm wrong please let me know).

In this article (https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux), it says that using '--fragment 0' (and '--mssfix 0') improves performance "by disabling OpenVPN's internal fragmentation routines... feeding larger packets to the OpenSSL encryption and decryption routines... The second advantage of not internally fragmenting packets is that this is left to the operating system and to the kernel network device drivers."

So, as I understand it (and again correct me if I'm wrong) '--fragment 0' could also be used to reduce the workload of the OpenVPN iOS app. At the very least, the '--fragment 0' directive should be considered for the next iOS app update.

jamesyonan

"fragment 0" on OpenVPN 2.x doesn't actually do anything. It essentially disables OpenVPN's internal fragmentation routines, however those routines are normally disabled by default anyway. Only "fragment n" where n is non-zero will actually enable OpenVPN's internal fragmentation routines.

The fragment directive is not for performance. It actually significantly reduces performance when used. Its use case is when you must communicate through misconfigured routers that don't properly manage IP fragmentation.

James

redradioflyer

Thanks for the explanation James!

FloJoe2.0

does anyone know when a new update comes out and whether you can then change the fragments