topic Remote access VPN WSL2 packet fragmentation in Firewall and Security Management

Remote access VPN WSL2 packet fragmentation

Honza — Wed, 04 Nov 2020 10:11:25 GMT

Hello guys,

we are facing an issue with remote access VPN and WSL2. The problem is in packet fragmentation. When a TCP packet is originated directly from the windows system it has the correct Maximum segment size value (1310). But when the packet is originated from WLS2 it has MSS 1460. The packet fragmentation does not work and for example, TSL session will fail.

We are fixing it with this workaround script in WSL.

#/bin/bash
ADVMSS=1310

DEFAULT_ROUTE=$(ip route | grep "default")
ip route del $DEFAULT_ROUTE
ip route add $DEFAULT_ROUTE advmss $ADVMSS
:
if ip route | grep -q "advmss $ADVMSS"; then
echo "MSS is ok"
else
echo "MSS is not ok"
fi

Is anyone having the same issue? What is your solution?

Re: Remote access VPN WSL2 packet fragmentation

_Val_ — Wed, 04 Nov 2020 12:11:59 GMT

Encrypted packets can hold less data because of the encryption, hence MTU of the packets sent to VPN tunnel should be reduced, to avoid fragmenting. You can find more details in sk98074. IT is for S2S, but should be relevant for RAS as well, as far as i know.

Limiting MTU on a network side is a solid approach

Re: Remote access VPN WSL2 packet fragmentation

Honza — Thu, 05 Nov 2020 15:42:39 GMT

I see. But I would expect the vpn client to mangle the TCP MSS value to correct value.