Dear lazyweb, I encounter MTU problems with an IPsec setup and NAT.
Here is a simplified version of my setup:
remote host < --- internet ---> (eth0) gateway (eth1) < --- LAN
As you may have guess, the gateway has only one public IP address and
thus the hosts on the LAN are connected to the internet through NAT.
The connection between the remote host and the gateway is secured using
IPsec (kame tools), and this works as expected as long, as the
connection is done between the remote host and the gateway. The problems
arise when I try to make a connection between the remote host and one
host from the LAN. Due to the use of IPsec, the MTU is reduced by 44
bytes, however "ICMP need to frag" packets are not emitted by the
gateway, so the connection just hangs.
I have tried various solution from the web (setting MTU on the various
interfaces, clamping MSS with iptables, defining advmss with ip route,
etc.), and the only one which actually works is reducing the MTU on the
LAN hosts. Not very useable given that they are a lot of hosts on the
LAN.
Note that when IPsec is disabled, if I lower the MTU of eth0, the "ICMP
need to frag" packets are correctly emitted, and the connection just
works.
Suggestions?