Suggestion regarding MTU issues

[jduan00]

Hi Gene,

In your doc you mentioned an issue with MTU size happened in a hotel. I have encountered this as well. Here is what I am reading and going to do my test:

https://gist.github.com/nitred/f16850ca48c48c79bf422e90ee5b9d95

FYI. Cheers!

Jack

[gene-git]

Very nice - thanks for sharing - I will move this to discussion so it stays up for others to see.

thank you again.

[jduan00]

More on this topic: https://blog.vitlabuda.cz/2022/10/15/clamping-tcp-mss-using-iptables.html

I am adding this to iptables firewall rules and will test for some clients having issues with normal MTU size.

https://gist.github.com/nitred/f16850ca48c48c79bf422e90ee5b9d95?permalink_comment_id=4836620#gistcomment-4836620

[jduan00]

My team member had issues before now reports this iptables rule change fixed it! Thus I am making it permanent on the WG server. This way no need for the client to fuss with MTU size, etc.

[gene-git]

thanks again for sharing. One thought that comes to mind, optimal choices depend on the entire path between client and server right - so each client-server path can be different.

So I wonder if PMTU discovery [1] is on on both ends under your controi (obviously other routers along the path you have no control over)

i.e. this setting should be 0 :

cat /proc/sys/net/ipv4/ip_no_pmtu_disc

[1] https://datatracker.ietf.org/doc/html/rfc4821

[gene-git]

Side note - I would encourage you to move from iptables to nftables (its far superior)

[jduan00]

Thanks for the tip! I am looking into your nft code. I have enabled client isolation (each client on the vpn don’t talk to each other) by rejecting wg0 to wg0 communications. I will see how to do this in nftables.

[gene-git]

In case of interest there are a couple of sample nftables scripts in my tech blog:

* https://github.com/gene-git/blog/tree/master/nftables

And info about setting maxseg size (MSS) here:

* https://wiki.nftables.org/wiki-nftables/index.php/Mangling_packet_headers

[jduan00]

I have to say I really like the simplicity and elegance of nftable conf and rule sets! I will spend more time on it and will rethinking the iptable based infr we have today. I always like to simplify. Thanks again for being so helpful in pointing this out.

[gene-git]

Glad you found it useful :)

[jduan00]

I am switching over from iptables to nftables!

[jduan00]

Now we are iptables free! Just to share with you our nftables conf.

#!/usr/sbin/nft -f
# Inspired by https://github.com/gene-git/wg_tool/blob/master/scripts/postup.nft
# nftables ruleset for Wireguard based VPN server
# JYD, 2024-01-19

define lan_iface  = ens3                 # lan interface
define wg_net     = 192.168.100.0/24     # wg network space

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority -50; policy accept;

        iifname "lo"  counter accept
        iifname "wg*" counter accept

        # stateful inspection
        ct state established,related counter accept
        ct state invalid             counter drop

        # To only allow ssh, wg, and ping
        ip protocol tcp tcp dport 22    ct state new limit rate 10/second burst 20 packets counter accept
        ip protocol udp udp dport 51820 ct state new limit rate 10/second burst 20 packets counter accept
        icmp type echo-request                       limit rate  5/second burst 10 packets counter accept
        
        counter drop
    }

    chain forward {
        type filter hook forward priority -50; policy accept;

        # To set max packet size, solve issue for some clients. wg mtu is 1420
        iifname "wg*" tcp flags syn counter tcp option maxseg size set 1384

        # stateful inspection
        ct state established,related counter accept
        ct state invalid             counter drop

        # wg client iolation: clients can't talk to each other.
        meta nfproto ipv4 iifname "wg*" oifname "wg*" counter reject with icmp admin-prohibited

        # allow all wg client with correct network packets
        iifname "wg*" ip saddr $wg_net counter accept

        counter reject
    }

    chain output {
        type filter hook output priority 0; policy accept;
        ct state invalid counter drop
    }

}

table inet nat {
    chain preroute {
        type nat hook prerouting priority -100; policy accept;
    }

    chain postrouting {
        type nat hook postrouting priority 100; policy accept;

        # NAT masquerade for wg clients to make it simple
        oifname $lan_iface ip saddr $wg_net masquerade
    }
}
# == EOF ==

[gene-git]

Congrats that's terrific!!
Hope it works well for you and thanks for sharing your nftables ruleset.
Have great weekend.

[jduan00]

Just updated it above to make it even more simpler. Just two variables at the top to config. I get this type of perf, and the server is only using about 15% CPU (2x cores). Amazing! Thanks again for your help!

[gene-git]

That looks awesome - happy things working nicely.