Saturday, February 14, 2009

Verizon DSL and MTU

From Brett Charbeneau of the Tidewater UNIX Users Group:

Verizon was adjusting the Maximum Transmission Unit of all
packets on the fly on their routers - and they stopped doing that recently.

Some sites, Microsoft Update in specific, demand that the MTU be between 1400 and 1536 or they simply won't interact with a browser. Any browser. At all.

Packets that have a frame size larger or smaller than that are ignored or otherwise mangled beyond recognition by any browser I know of.

So, if you are like me and have several locations sharing Verizon DSL
circuits between lots of Windows users via an iptables-based firewall/router, Microsoft Update,, and a bunch of other sites suddenly became inaccessible on February 9, 2009 for no apparent reason.

The fix is to set a "clamp" on packet size via a variety of iptables
commands, I like to do it in the FORWARD chain like so (all one line):

# iptables -I FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu

but here are other ways to do it.

No comments: