So I'm stumped, I've read tens of MTU related threads and haven't been able to find anything which solves the problem... I'm trying to connect two cloud networks together, one is Amazon Web Services VPC, the other is a vmware cloud provider, at each end I have a RedHat box, 7.1 on AWS and 6.5 on the other provider. My server (AWS) configuration is as follows: [code] local 0.0.0.0 port 1194 proto udp dev tun0 ca aws/ca.crt cert aws/server.crt key aws/server.key dh aws/dh2048.pem persist-key persist-tun cipher AES-256-CBC tls-auth aws/ta.key 0 key-direction 0 client-config-dir aws/ccd ifconfig-pool-persist aws/ipp.txt status /var/log/openvpn/server-status.log log /var/log/openvpn/server.log keepalive 1 10 comp-lzo user nobody group nobody verb 3 script-security 2 server 10.21.0.0 255.255.255.0 push "route 172.21.0.0 255.255.0.0" route 172.20.0.0 255.255.0.0 [/code] CCD for client: [code] iroute 172.20.0.0 255.255.254.0 iroute 172.20.64.0 255.255.254.0 iroute 172.20.66.0 255.255.254.0 iroute 172.20.128.0 255.255.255.0 [/code] Client config (vcloud): [code] client dev tun1 proto udp remote X.X.X.168 1194 resolv-retry infinite nobind persist-key persist-tun ca aws/ca.crt cert aws/client.crt key aws/client.key ns-cert-type server tls-auth aws/ta.key 1 cipher AES-256-CBC comp-lzo verb 3 script-security 2 keepalive 1 10 key-direction 1 log /var/log/openvpn/aws.log [/code] With the above configurations UDP traffic does not work and HTTP requests fail, SSH and ICMP works fine... which I'm not surprised by as I haven't changed any MTU settings yet... Now then, adding: [code] mssfix 1000 fragment 1000 [/code] to both the client and server fixes the issues for the server, it can successfully perform a DNS lookup and establish a HTTP connection to hosts in the vcloud network, however, hosts in AWS aren't able to perform DNS lookups routing via the openvpn server, but they can still successfully ping and SSH... so it seems changing these values fixed the problem for the server, but not anything routing through the server - I've played with several of the other mtu config options and many of them solve the problem for the server, but none seem to solve the problem for the hosts in AWS that route via the OpenVPN server. ifconfig server: [code] [root@ip-172-21-0-9 ec2-user]# ifconfig eth0: flags=4163 mtu 9001 inet 172.21.0.9 netmask 255.255.255.240 broadcast 172.21.0.15 inet6 fe80::cf:9dff:fe70:e75f prefixlen 64 scopeid 0x20 ether 02:cf:9d:70:e7:5f txqueuelen 1000 (Ethernet) RX packets 214937 bytes 42146397 (40.1 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 229531 bytes 31798129 (30.3 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 lo: flags=73 mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10 loop txqueuelen 0 (Local Loopback) RX packets 4 bytes 420 (420.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 4 bytes 420 (420.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 tun0: flags=4305 mtu 1500 inet 10.21.0.1 netmask 255.255.255.255 destination 10.21.0.2 unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 0 bytes 0 (0.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 [/code] ifconfig client: [code] [root@vpn001-01 geraint]# ifconfig eth0 Link encap:Ethernet HWaddr 00:50:56:01:16:24 inet addr:172.20.0.8 Bcast:172.20.0.255 Mask:255.255.255.0 inet6 addr: fe80::250:56ff:fe01:1624/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:44183793 errors:0 dropped:0 overruns:0 frame:0 TX packets:41960348 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:28094767505 (26.1 GiB) TX bytes:20589018480 (19.1 GiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:403852 errors:0 dropped:0 overruns:0 frame:0 TX packets:403852 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:18166722 (17.3 MiB) TX bytes:18166722 (17.3 MiB) tun1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.21.0.6 P-t-P:10.21.0.5 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) [/code] Can anyone help me? Cheers

AWS MTU Problem

geraint

So I'm stumped, I've read tens of MTU related threads and haven't been able to find anything which solves the problem...

I'm trying to connect two cloud networks together, one is Amazon Web Services VPC, the other is a vmware cloud provider, at each end I have a RedHat box, 7.1 on AWS and 6.5 on the other provider.

My server (AWS) configuration is as follows:

local 0.0.0.0
port 1194
proto udp
dev tun0

ca aws/ca.crt
cert aws/server.crt
key aws/server.key
dh aws/dh2048.pem
persist-key
persist-tun
cipher AES-256-CBC
tls-auth aws/ta.key 0
key-direction 0

client-config-dir aws/ccd

ifconfig-pool-persist aws/ipp.txt
status /var/log/openvpn/server-status.log
log /var/log/openvpn/server.log

keepalive 1 10

comp-lzo
user nobody
group nobody
verb 3
script-security 2

server 10.21.0.0 255.255.255.0

push "route 172.21.0.0 255.255.0.0"

route 172.20.0.0 255.255.0.0

CCD for client:

iroute 172.20.0.0 255.255.254.0
iroute 172.20.64.0 255.255.254.0
iroute 172.20.66.0 255.255.254.0
iroute 172.20.128.0 255.255.255.0

Client config (vcloud):

client
dev tun1
proto udp
remote X.X.X.168 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca aws/ca.crt
cert aws/client.crt
key aws/client.key
ns-cert-type server
tls-auth aws/ta.key 1
cipher AES-256-CBC
comp-lzo
verb 3
script-security 2
keepalive 1 10
key-direction 1

log /var/log/openvpn/aws.log

With the above configurations UDP traffic does not work and HTTP requests fail, SSH and ICMP works fine... which I'm not surprised by as I haven't changed any MTU settings yet...

Now then, adding:

mssfix 1000
fragment 1000

to both the client and server fixes the issues for the server, it can successfully perform a DNS lookup and establish a HTTP connection to hosts in the vcloud network, however, hosts in AWS aren't able to perform DNS lookups routing via the openvpn server, but they can still successfully ping and SSH... so it seems changing these values fixed the problem for the server, but not anything routing through the server - I've played with several of the other mtu config options and many of them solve the problem for the server, but none seem to solve the problem for the hosts in AWS that route via the OpenVPN server.

ifconfig server:

[root@ip-172-21-0-9 ec2-user]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 9001
        inet 172.21.0.9  netmask 255.255.255.240  broadcast 172.21.0.15
        inet6 fe80::cf:9dff:fe70:e75f  prefixlen 64  scopeid 0x20<link>
        ether 02:cf:9d:70:e7:5f  txqueuelen 1000  (Ethernet)
        RX packets 214937  bytes 42146397 (40.1 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 229531  bytes 31798129 (30.3 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 0  (Local Loopback)
        RX packets 4  bytes 420 (420.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 4  bytes 420 (420.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.21.0.1  netmask 255.255.255.255  destination 10.21.0.2
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ifconfig client:

[root@vpn001-01 geraint]# ifconfig
eth0      Link encap:Ethernet  HWaddr 00:50:56:01:16:24  
          inet addr:172.20.0.8  Bcast:172.20.0.255  Mask:255.255.255.0
          inet6 addr: fe80::250:56ff:fe01:1624/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:44183793 errors:0 dropped:0 overruns:0 frame:0
          TX packets:41960348 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:28094767505 (26.1 GiB)  TX bytes:20589018480 (19.1 GiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:403852 errors:0 dropped:0 overruns:0 frame:0
          TX packets:403852 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:18166722 (17.3 MiB)  TX bytes:18166722 (17.3 MiB)

tun1      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.21.0.6  P-t-P:10.21.0.5  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

Can anyone help me?

Cheers

Traffic

geraint wroteI've read tens of MTU related threads and haven't been able to find anything which solves the problem...

What exactly is the problem ? What evidence do you have that there is anything wrong with standard MTU 1500 ?

geraint wroteifconfig server:
Code:
[root@ip-172-21-0-9 ec2-user]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 9001

Did you manually set MTU 9001 ?