Persistant MTU change for Wireguard Site-to-Site VPN

Follow

Alan

• September 18, 2024 15:48

Hi Firewalla Community,

I've diagnosed an issue on my Wireguard Site-to-Site VPN between two Firewalla Golds down to the default MTU setting on the VPN pipe. The default 1412 is too high and manually setting this to 1300 resolves my dropped packet issue between the two sites. 

I can manually change the MTU on the VPN pipe once it is up with:

       sudo ip link set dev wg0 mtu 1300 
       equivalent command on the other end

But I need to persist this between Firewalla reboots and between the VPN dropping and reconnecting. I'm familiar with custom scripting for Firewalla (https://help.firewalla.com/hc/en-us/articles/360054056754-Customized-Scripting) but am not sure about how best to tie into resetting the MTU when the VPN tunnel is reconnected. I tried creating a script and placing it in /etc/network/if-up.d but the script isn't getting called with the VPN tunnel comes back up. I could setup a cron job that runs every few minutes, but that feels a bit too hackish. 

Any suggestions on how best to tie into network interface changes on the Firewalla device?

Thanks,
Alan 

 

 

0

• 

  Firewalla

  • September 18, 2024 18:13

  Most of the time you shouldn't need to change the MTU between the client and the server side. May I know what ISP are you using? (or the protocol being used on the WAN side of both sites?)

  Are you running other VPN protocols over the WireGuard VPN?

   

  0

  Comment actions Permalink
• 

  Alan

  • September 18, 2024 19:49

  I have a separate support ticket (87028) that has been open working through this issue. And based on additional testing on my part have clearly nailed down the problem with the MTU on the VPN Tunnel. And I've confirmed that manually setting the MTU to 1300 on each end of the tunnel resolves all the problems I've had. Comcast on one end and Comcast Community wifi on the other end. And yes there are other Wireguard VPNs on these Firewallas. 

  So I know MTU is the issue and solution. Now I just need to figure out the best way to persist a change.

  0

  Comment actions Permalink
• 

  Firewalla Team

  • September 19, 2024 09:38

  Our engineer will work with you on support ticket 87028.

  0

  Comment actions Permalink
• 

  tahoe250

  • September 22, 2024 23:22

  Is there any update to this?  I am also looking to adjust the MTU.

  0

  Comment actions Permalink
• 

  Alan

  • September 28, 2024 15:13

  I ended up making a user cron job that runs every 5 minutes on each firewall to set the MTU on the connection. This is working and the site-to-site VPN is functional. I have SNMP enabled on my firewalls and do see a higher number of packet errors than I'd like on the server side of the site-to-site VPN -- but it doesn't appear to be impacting functionality. 

  0

  Comment actions Permalink

Please sign in to leave a comment.