<html><body><div style="font-family: terminal,monaco; font-size: 10pt; color: #000000"><div><span style="color: #000000; font-family: terminal, monaco; font-size: 13.3333px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;" data-mce-style="color: #000000; font-family: terminal, monaco; font-size: 13.3333px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;">> Most likely broken path mtu discovery, see:</span><br style="color: #000000; font-family: terminal, monaco; font-size: 13.3333px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; text-decoration-style: initial; text-decoration-color: initial;" data-mce-style="color: #000000; font-family: terminal, monaco; font-size: 13.3333px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; text-decoration-style: initial; text-decoration-color: initial;"><span style="color: #000000; font-family: terminal, monaco; font-size: 13.3333px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;" data-mce-style="color: #000000; font-family: terminal, monaco; font-size: 13.3333px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;">> https://libreswan.org/wiki/FAQ#My_ssh_sessions_hang_or_connectivity_is_very_slow</span><br style="color: #000000; font-family: terminal, monaco; font-size: 13.3333px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; text-decoration-style: initial; text-decoration-color: initial;" data-mce-style="color: #000000; font-family: terminal, monaco; font-size: 13.3333px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; text-decoration-style: initial; text-decoration-color: initial;"><div style="clear: both;" data-mce-style="clear: both;"><br></div></div><div>Thank you for your answer, but I already tried any of those solutions (tried almost every value from 1500 down to 250), without actually fixing the problem at all.</div><div>Any other help? Keep in mind that I have other tunnels between the hosts the one behind NAT is connecting to, and when NAT-ed host is not involved, I've no problems at all.</div><div><br data-mce-bogus="1"></div><div>Regards,</div><div>Davide.</div><div><br>**********<br><br>Davide Pucci<br>Systems and Software Engineer<br>Mob: +39 348 923 7278<br>Tel: +39 06 5960 2069<br>Fax: +39 06 5960 6185<br>Email: d.pucci@i-node.it<br><br>I-node s.r.l.<br>We build you® .biz<br>Via di San Giovanni in Laterano, 84 - 00184 Roma (RM)<br>Twitter: http://www.twitter.com/i_node<br>Sito Web: http://www.i-node.it</div><br><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>Da: </b>"Paul Wouters" <paul@nohats.ca><br><b>A: </b>"Davide Pucci" <d.pucci@i-node.it><br><b>Cc: </b>"swan" <swan@lists.libreswan.org><br><b>Inviato: </b>Mercoledì, 20 dicembre 2017 22:02:06<br><b>Oggetto: </b>Re: [Swan] Tunnel behind NAT: large packets freeze it<br></div><br><div data-marker="__QUOTED_TEXT__">On Wed, 20 Dec 2017, Davide Pucci wrote:<br><br>> I need your help as I'm facing several issues without some Swan IPsec tunnels: they all are built between a NAT-ed<br>> host (running openswan) and a publicly exposed one (running libreswan).<br>> I can always reproduce the issue by executing "for i in {0..30}; do ps ax; done" or "dd if=/dev/urandom bs=10M": it<br>> seems that if I run commands with large outputs tunnel goes down.<br>> The first - behind NAT - host has the configuration file attached as h1-to-h2.conf; similarly, the latter, the one<br>> named h2-to-h1.conf.<br><br>Most likely broken path mtu discovery, see:<br><br>https://libreswan.org/wiki/FAQ#My_ssh_sessions_hang_or_connectivity_is_very_slow<br><br>Paul<br></div></div></body></html>