topic Re: lowering mtu on remote access vpn? in General Topics

lowering mtu on remote access vpn?

flwsterN — Wed, 11 Jun 2025 20:23:34 GMT

Hello i was wondering if its possible to lower the mtu on the remote access client endpoint vpn or the gw?

In my homelab i have built this MPLS network (in the cloud) that is the connection between my home + and summer house. It runs wireguard + gre in the bottom so the maximum mtu of a packet cannot go over 1380 mtu and with ipsec on top of that i think the mtu has to go down to like 1280-1300 on that ipsec tunnel is it possible to configure that on a Checkpoint? Cant find anything on it.

Best regards,

Re: lowering mtu on remote access vpn?

PhoneBoy — Wed, 11 Jun 2025 22:11:42 GMT

You can adjust the MTU of VPN traffic by setting the MSS size for VPN traffic.
See: https://support.checkpoint.com/results/sk/sk101219

Re: lowering mtu on remote access vpn?

the_rock — Wed, 11 Jun 2025 22:24:37 GMT

You can change MTU on relevant interface from clich -> set interface ethxx mtu and then whatever size needed.

Then save config to save the setting.

Andy

Re: lowering mtu on remote access vpn?

the_rock — Fri, 13 Jun 2025 17:05:14 GMT

Hey @flwsterN

Any luck with this?

Andy

Re: lowering mtu on remote access vpn?

flwsterN — Fri, 13 Jun 2025 21:49:48 GMT

Hello sorry late reply it seemed it was never a mtu problem (im doing mtu mss outside checkpoint) i had to open up ports 500 and 4500 but its wierd it always worked from my iphone which also says its using ipsec. Or does the iphone do it over 443?

Everything works fine now doing ipsec on top of wireguard + gre 🙂

Re: lowering mtu on remote access vpn?

flwsterN — Fri, 13 Jun 2025 21:53:49 GMT

Re: lowering mtu on remote access vpn?

the_rock — Fri, 13 Jun 2025 22:08:20 GMT

Port 443 is always needed for remote access. Check out below post about it.

Andy

https://community.checkpoint.com/t5/Remote-Access-VPN/Remote-access-without-visitor-mode-enabled/td-p/77398

Re: lowering mtu on remote access vpn?

flwsterN — Fri, 13 Jun 2025 22:17:46 GMT

Yes but why is it working without opening 4500/500 when coming from Iphone vs mac/windows?

Re: lowering mtu on remote access vpn?

the_rock — Fri, 13 Jun 2025 22:35:56 GMT

I believe iphone would need only udp port 500, not udp 4500.

Andy

Re: lowering mtu on remote access vpn?

PhoneBoy — Mon, 16 Jun 2025 14:54:17 GMT

Our VPN clients require a connection over HTTPS (TCP/443) to start the connection.
In some cases, this will also be used for the actual VPN transport (so called "Visitor Mode").