Skip to content

feat(ns-plug): add MTU test and configurable MTU field #1310

@Tbaile

Description

@Tbaile

Brief description

Currently, users experience connectivity issues due to incorrect MTU settings between NethSecurity firewalls and controllers, especially in low-quality network environments. Workarounds like manually setting MTU on the tunnel or using ifconfig are not persistent after VPN reconnections, and troubleshooting is difficult without clear visibility into MTU-related problems.

Proposed solution

  • Integrate an MTU test into the ns-plug client so logs immediately highlight MTU issues, allowing easier diagnosis with a simple grep.
  • Add a configurable MTU field to ns-plug's configuration, making MTU adjustments persistent and manageable by users directly from configuration—no manual intervention needed after VPN reconnects.

Alternative solutions

  • Only expose MTU setting on either the controller or firewall (less flexible, may not resolve all scenarios).
  • Use OpenVPN options (--tun-mtu, --fragment, --mssfix) for more dynamic adaptation, but requires additional patching and environment variable support in the VPN container/module.

Additional context

  • Reference implementation ideas from
    # Configuration received, setup the VPN
    host=$(echo ${response} | jq -r .data.host)
    port=$(echo ${response} | jq -r .data.port)
    cert=$(echo ${response} | jq -r .data.cert)
    key=$(echo ${response} | jq -r .data.key)
    ca=$(echo ${response} | jq -r .data.ca)
    cat <<EOF > ${CONFIG_FILE}
    client
    server-poll-timeout 5
    nobind
    float
    explicit-exit-notify 1
    remote ${host} ${port} udp
    connect-retry-max 5
    dev tun-nsplug
    tls-client
    script-security 2
    route-up /usr/sbin/ns-controller-push-info
    <ca>
    ${ca}
    </ca>
    <cert>
    ${cert}
    </cert>
    <key>
    ${key}
    </key>
    auth-nocache
    verb 3
    EOF

References

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

Status

In Progress 🛠

Relationships

None yet

Development

No branches or pull requests

Issue actions