[LUGOS] NAT, MTU, blokiranje ICMP-ja ipd.

[Rok Pintar]

> med RT1 in Slashdot je nekaj, kar blokira ves ICMP promet, vkljucno z ICMP 
> fragmentation needed paketi. Nato se zgodi tole:
> 
> Ce je to v 2.4 bolje reseno (ali pa tudi v kaksnem novejsem 2.2), potem je 
> OK, upgrade ni problem, ampak testiral pa tega ne bi, ker je nekoliko prevec 
> dela... 

Po mojem potrebujes tole iz 2.4.x:

CONFIG_IP_NF_TARGET_TCPMSS
  This option adds a `TCPMSS' target, which allows you to alter the
  MSS value of TCP SYN packets, to control the maximum size for that
  connection (usually limiting it to your outgoing interface's MTU
  minus 40).

  This is used to overcome criminally braindead ISPs or servers which
  block ICMP Fragmentation Needed packets.  The symptoms of this
  problem are that everything works fine from your Linux
  firewall/router, but machines behind it can never exchange large
  packets:
        1) Web browsers connect, then hang with no data received.
        2) Small mail works fine, but large emails hang.
        3) ssh works fine, but scp hangs after initial handshaking.

  Workaround: activate this option and add a rule to your firewall
  configuration like:

        iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
                 -j TCPMSS --clamp-mss-to-pmtu


ROK