Issue of MSS on IPSEC VPN [follow up]

Question

There is a well-known IPSEC VPN performance issue which can be resolved by adding this command: 
 iptables -I FORWARD 1 -o -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1320 
 This command works fine from the console for me. In order to survive a reboot, I added it to /etc/init.d/iptables in the start section just below: iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 
 I rebooted the UTM and then checked with: iptables -n -L --line-numbers 
 I expected to see: 
 Chain FORWARD (policy DROP) 
 num target prot opt source destination 1 TCPMSS tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS set 1320 .. .. 
 but there is no such line at all 
 Does any of you know a solution? I'm running UTM 9.705 
 Best wishes, JockyW

jockyw2001 · Answer

By running a script each minute via cron I finally got it to work. 
 This is the script /root/iptables-tcp-mss.sh: #!/bin/bash iptables -C FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1320 || iptables -I FORWARD 1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1320 
 This is the cron job to be added in /etc/crontab-static and then cycle Up2date config from daily -> manual -> daily which then causes crontab to be updated: # Start custom iptables script every 1 minute * * * * * root /root/iptables-tcp-mss.sh 
 Thx tom k. ! 
 EDIT: it is ncessary to reinit ipsec after updating tcp mss to 1320. So I added that to iptables-tcp-mss.sh : 
 #!/bin/bash #iptables -C FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1320 || iptables -I FORWARD 1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1320 # or like this to initialize ipsec after setting mss to 1320: iptables -C FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1320 ; if [ $? -eq 1 ]; then iptables -I FORWARD 1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1320 /usr/local/bin/confd-client.plx set ipsec status 0 wait $! /usr/local/bin/confd-client.plx set ipsec status 1 wait $! fi

Issue of MSS on IPSEC VPN [follow up]

Top Replies