-
-
Notifications
You must be signed in to change notification settings - Fork 2.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
For GCE deployments, automatically set max_mss, or prompt the user to set it #1217
Comments
I was able to confirm this -- many requests (especially ones to google properties, interestingly) will fail with the default MSS/MTU on GCE.
This sounds good to me. We'd appreciate a PR! |
It might be worthwhile to handle WireGuard separately since it allows the MTU to be set directly in the client configuration files. For example, create an additional variable The default MTU for WireGuard set by |
Rather than add a second variable for WireGuard as I suggested above and force users to do MTU and MSS math, I've created a fork that replaces However I'm not currently set up to deploy to GCE. Could a GCE user following this issue give it a try? Get a copy of my fork with:
Then edit If you find this works for you I'll submit a PR. @lperry This code doesn't set |
@davidemyers I think it might be confusing. How about just put fixed mtu size in the config? I'll file a PR with the changes for GCE shortly |
@jackivanov I was trying to come up with a single variable which would work for both IPsec and WireGuard which have different MTUs. |
@davidemyers I'll try to give it a shot tomorrow or day after. Thanks! |
@jackivanov How about if I simplify the description:
|
@davidemyers Your branch looks good to me. I brought up a new GCE deployment with your changes, and verified I was able to browse a few sites with either IPsec or WireGuard active. |
@davidemyers I'd rather let users chose the MTU size, instead of hardcoded values. I'll send a branch with examples later today |
@davidemyers it's here |
@jackivanov I have some questions about that approach. Apple devices use an MTU of 1400 for IPsec, and the Linux and iOS WireGuard implementations use an MTU of 1420. These seem to be working fine for Algo users on cloud providers with a normal MTU. But when the MTU must be reduced, how does the user set an optimal value for both IPsec and WireGuard? Also, for IPv6 isn't MSS = MTU - 60? |
@davidemyers I thought that we can reduce this complexity by setting the same value for both IPsec and WG. Would there be any problems if we do that? I haven't encountered any problems so far using my approach, but if there would be any in the future we'd better to use |
Aside from being slightly non-optimal for WireGuard, the only problems I can think of are:
|
OK, I see. Let's stick with reduce_mtu then. Could you send a PR please? |
Will do. This change will make the MTU instructions in the troubleshooting document obsolete. Is it OK with you if I submit a PR without updating troubleshooting and go back and update it in a later PR? |
@davidemyers I think it would be better to put everything in one PR |
OK, then I will need a day or so to put the troubleshooting section together, then I'll submit a PR. |
@jackivanov I finished the PR, but then had another idea. What if by default This should work for GCE and perhaps other providers. If you think this is a good idea I'll add it to the PR. Of course it won't handle the case where the MTU is limited on the client side. Edited to add: I went ahead and implemented this and it works when deploying to GCE. When deploying to DigitalOcean it makes no MTU changes unless |
@davidemyers Yes, I like this idea. |
@lperry @woodruffw I submitted PR #1253 which should allow you to deploy to GCE without any MTU or MSS changes on your part. Please give it a try. |
Prior to #976,
max_mss
used to be set for GCE deployments automatically (see https://github.com/trailofbits/algo/pull/976/files#diff-28f2b95533afb47cbec1d823b0f1a941L535). Now thatmax_mss
is undefined, GCE deployments no longer appear to work out of the box. I brought up a new GCE deployment on November 23, and noticed I was unable to load sites in my browser until I redeployed withmax_mss
set to 1316, the default value listed in config.cfg.Can the previous behavior of automatically setting
max_mss
for GCE deployments be brought back, or can the user be prompted to setmax_mss
(maybe default to 1316)?If either approach sounds good, I can open a PR with the changes.
Thanks!
The text was updated successfully, but these errors were encountered: