Hello, Grant Taylor a écrit :
The first thing that comes to mind is that you may be dealing with an MTU / MSS issue. Some of your connections work and some never seem to start, which is a classic symptom of an MTU / MSS mis-match with the ICMP error being filtered out along the way.
Or with the ICMP error not being generated at all, because of the MTU mismatch not occuring at an IP device. This is quite common with a DSL modem acting as transparent bridge : as it works only at the link layer, when it receives a PPPoE frame bigger than 1500 bytes from the ISP, it cannot either forward it on the ethernet link, fragment it or send an ICMP error.
The ISP routers should be responsible for doing the fragmentation and sending ICMP errors. But unfortunately they don't always do it. Sometimes the ISP don't even know the customer uses PPPoE, for example when it uses a third-party DSL carrier which deals with the PPPoX stuff and delivers user sessions to the ISP in L2TP tunnels.
Try playing with the TCPMSS match extension and target to clamp the MSS to some lower values.
Be aware that this workaround only works for TCP, not for other IP protocols such as UDP, ICMP (big pings), GRE, IPSec (AH, ESP), IPIP, 6in4...
-- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
