VPN

I have two monowalls connected via a IPSec VPN (on a LAN). Large packets eg "ping -l 2048" on windows, do not reliably work. Other large packets eg UDP Kerberos for Active Directory are also damaged.

This line from syslog shows the (part of?) first packet of a 4 packet ping being blocked by the local firewall even through of course the default LAN rule is in place.  The first ping failed, the next three worked ok. Sometimes I can do serveral bursts of a 100 pings, sometimes not.

This is a 1.3b15 monowall sending the pings. 1.235 seems much worse.

I have turned on _every_ option for large fragments (ie advanced options and each rule).

ipmon[128]: 21:55:11.649191 vr0 @100:2 b 192.168.122.199 -> 192.168.1.1 PR icmp len 20 (596) (frag 10678:576@1480) IN

These seems like a real bug. And is disasterous for us, sadly we must use AD. We replaced a bunch of Watchguards with monowalls and now I look like a dope for recommending them.

Please help, you're my only hope.

I just confirmed the same IPSec packet loss problem between two 1.3b15 m0n0walls.  0% packet loss with ping -l 1024 and ~ 10% with -l 2048.

Update1: -l 4096 is back to 0% packet loss - Very Strange.

Update2: Forgot to mention, I am not experiencing and AD problems at all.

CS...

I too found 4096 seemed to work more often that 2048!

Fragments are dropped by the default LAN rule, if you need them, edit that rule and allow them.

I already have that boxed checked.  Have you tried this test for yourself?

CS...

[I have turned on _every_ option for large fragments (ie advanced options and each rule).]

Fragments are dropped by the default LAN rule, if you need them, edit that rule and allow them.

I have turned on _every_ option for large fragments (ie advanced options and each rule).