I-MSS clamping esangweni le-VPN: ikulungisa ini futhi ingakulungisi ini
I-clamping ibhala kabusha i-MSS kuma-handshake e-TCP ukuze amasegmenti angena kumhubhe. Ayilokothi ilungise i-UDP noma ukuhlolwa kwe-path-MTU okonakele. Izihlolo ezintathu, ngokulandelana.
Izicelo ezincane ziyasebenza, ukulandwa okukhulu kuyama, futhi othile uphakamisa i-MSS clamping. Leso siphakamiso silungile kaningi ngokwanele ukuthi kufanele kuzanywe ngokulandelana okufanele, futhi asilungile kaningi ngokwanele ukuthi kungamosha intambama uma usisebenzisa ngokungacabangi. Izihlolo ezintathu ngezansi zihlukanisa inkinga yangempela yosayizi we-TCP enkingeni ye-UDP, ekutholakaleni kwe-path-MTU okonakele, kanye ne-clamp engayiboni neze i-handshake okufanele iyibhale kabusha.
Qala ngokuma kokwehluleka
Ukwehluleka kosayizi kunesiginesha: uxhumano luyasungulwa, ukuqinisekiswa kanye nezimpendulo ezincane ziyaphumelela, bese ukudluliswa kuma unomphela lapho kudingeka isegmenti yosayizi ogcwele. Amakhasi alayisha umbhalo kodwa angasiqedi isithombe isikhathi ngasinye nawo lowo mhlolo esikalini esincane. Uma kungaxhunyi lutho nhlobo, inkinga isendleleni ngaphambili futhi i-clamping ngeke isize. I-clamp ayikwazi ukulungisa i-handshake engakaze ifike.
Le siginesha ikhona ngoba usayizi wesegmenti kuvunyelwana ngawo kuleyo handshake. Uhlangothi ngalunye lumemezela usayizi wesegmenti ophezulu njengokukhetha kwe-TCP, futhi abathumeli bayahlonipha isimemezelo sohlangothi olunye. Uma indlela ingeke ithwale isegmenti enkulu kangako, ukwehluleka kuvela kamuva, lapho umthumeli ezama okukodwa.
Gcina ukuthutha kusemehlweni ngesikhathi ufunda leso sibonakaliso. I-clamping iwukubhala kabusha kokukhetha kwe-TCP, ngakho ukushaywa kwezwi noma ividiyo okuma ngaphansi komhubhe ofanayo akusiyo inkinga ye-MSS futhi ngeke kube ngcono ngayo. Bhala phansi ukuthutha ngaphambi kokuthinta ukukhetha kwe-TCP.
Linganisa indlela, bese uyiqhathanisa nomhubhe
Izinombolo ezimbili zibalulekile futhi zivame ukudidaniswa. I-path-MTU iyiphakethe enkulu kakhulu indlela eyithwalayo ngaphandle kokuhlukaniswa, futhi i-MSS emenyezelwe ye-IPv4 yilelo nani kukhishwe amabhayithi angu-40 ekhanda le-IP ne-TCP, noma kukhishwe angu-60 kwe-IPv6. Ukufakwa komhubhe kudla ingxenye yesabelomali ngaphambi kokuba iphakethe langaphakathi liqale.
ping -M do -s 1400 198.51.100.20
tracepath 198.51.100.20I-ping enebhithi ye-do-not-fragment ikutshela ukuthi iphakethe lalelo sayizi lomthwalo liyasinda yini; shintsha usayizi kuze kwehluleke futhi usuthole umkhawulo wendlela ngokuhlangenwe nakho. Umphumela we-tracepath ubika i-MTU etholakale endleleni, okusheshayo uma kusebenza futhi kungathembeki kancane uma i-hop ephakathi ihlunga izivivinyo.
Manje susa izindleko zomhubhe. Ikhanda le-IP langaphandle, ikhanda le-UDP nekhanda eliqondene nomhubhe konke kuphuma kumabhayithi angu-1500 afanayo, ngakho i-MTU yangaphakathi esebenzisekayo esisekelweni se-Ethernet ejwayelekile iphansi kunalokho okushiwo uxhumano lomzimba. Uma i-MTU yangaphakathi ebaliwe iphansi kunalokho okumenyezelwa ontanga yakho, uthole umgadli we-clamp wangempela hhayi ukuqagela. Uma inani elibaliwe seliphezulu kunokumenyezelwa kontanga, ma lapha futhi ubheke kwenye indawo.
Beka i-clamp lapho kudlula khona i-handshake
I-clamp isebenza ngokubhala kabusha ukukhetha kwe-MSS kumaphakethe e-SYN ne-SYN-ACK njengoba enqamula isango. Uma umthetho uhlala kusixhumanisi okungekho uhlangothi oludlula kulo, izingxoxo ziphetha zingashintshile futhi isibonakaliso sihlala, yingakho indawo inquma umphumela ngaphezu kwenani.
| Symptom | What it points to | Next check |
|---|---|---|
| Handshake completes, large transfer stalls | Segment size larger than the path can carry | Path MTU against the tunnel's effective MTU |
| Nothing connects, small or large | Routing, firewall or keying failure | Not MSS; look at the tunnel state |
| Only UDP applications stall | Datagram size or a dropped ICMP error | Platform-specific UDP handling, not clamping |
| Fixed after reconnect, returns later | Clamp applied to one direction or one interface | Rule placement and the handshake path |
Uhlangothi yingxenye yesibili. I-clamping yohlangothi olulodwa ilungisa uhhafu wemigudu futhi ishiye okunye kwehluleka ngendlela ebonakala njengefika ngezikhathi ezithile, ngakho yisebenzise kuzo zombili izinhlangothi zokuthutha okudluliswayo. Indlela yakudala ye-Linux yesixhumanisi somhubhe umthetho we-mangle ohambisana namaphakethe e-SYN:
iptables -t mangle -A FORWARD -o tun0 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtuQaphela ukuthi i---clamp-mss-to-pmtu yenzani ngempela: ithola inani ku-MTU yomzila, okungeyona njalo isabelomali sangempela somthwalo womhubhe. Emhubheni osuselwa emzileni lapho umzila wangaphakathi nomzila wangaphandle wehluka, inani elicacile elibalwe esihlolweni esandulele liqageleka kalula kunelizenzakalelayo.
Qinisekisa ngoxhumano olusha, futhi gcina impendulo iphila
Uxhumano olusunguliwe lugcina i-MSS eluxoxe ngayo, ngakho ukuhlola kuseshini efanayo akufakazi lutho. Vula uxhumano olusha ngemuva koshintsho futhi ufunde inani okuvunyelwene ngalo ngqo esikhundleni sokulicabangela kusuka ekudlulisweni okuphele ngengozi.
ss -tin dst 198.51.100.20
iptables -t mangle -S | grep TCPMSSUmyalo wokuqala ubika i-MSS yesokhethi kanye nesimo sayo sokugcwala, okuwukuqinisekisa okushesha kakhulu ukuthi i-clamp isebenzile. Owesibili uqinisekisa ukuthi umthetho ocabanga ukuthi uwengezile yiwo umthetho okhona, kulelo thebula owabekwa kulo.
Bese uvikela indlela ongayilungisanga. Ukutholakala kwe-path-MTU kuncike ekutheni imilayezo ye-ICMP fragmentation-needed ifinyelela kumthumeli, ngakho i-firewall ewulahayo izoqhubeka nokwephula ukudluliswa okukhulu ngisho ne-clamp efanele. Vumela leyo milayezo endleleni yomhubhe, noma wamukele ukuthi i-clamping inxephezele inqubomgomo oyikhethile.
Ekugcineni, melana nesihebo sokuthatha i-clamp njengesihluzo sokulungisa. Ikhawulela usayizi wesegmenti, okubiza umthamo emizileni engakaze iwudinga. Uma isetshenziswe ngemuva kwezihlolo ezintathu iwukulungisa okuqondiwe; uma isetshenziswa kuqala iwushintsho olufihla iphutha lokuqala futhi lwengeza okuhlukile kwesibili kusivivinyo ngasinye esilandelayo. Lokho kushintshana kufanele kwenziwe ngamabomu, hhayi ngokuzenzakalela.
Bhala phansi i-path-MTU oyilinganisile, izindleko zomhubhe ozisusile, umthetho owengezile ne-MSS oyibonile ngemuva kwalokho. Izinombolo ezine zenza isigameko esilandelayo sibe ukusesha esikhundleni sophenyo.