From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.3 required=3.0 tests=DKIM_ADSP_CUSTOM_MED, DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,HTML_MESSAGE,MAILING_LIST_MULTI, NUMERIC_HTTP_ADDR,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C612BC3F68F for ; Fri, 14 Feb 2020 10:58:42 +0000 (UTC) Received: from krantz.zx2c4.com (krantz.zx2c4.com [192.95.5.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 6541B2168B for ; Fri, 14 Feb 2020 10:58:42 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="LpjHsT/Q" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 6541B2168B Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=wireguard-bounces@lists.zx2c4.com Received: from krantz.zx2c4.com (localhost [IPv6:::1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 0a1c1a15; Fri, 14 Feb 2020 10:54:44 +0000 (UTC) Received: from krantz.zx2c4.com (localhost [127.0.0.1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 4a21b50d for ; Sun, 9 Feb 2020 05:24:40 +0000 (UTC) Received: from mail-ed1-x52d.google.com (mail-ed1-x52d.google.com [IPv6:2a00:1450:4864:20::52d]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 3fa207c7 for ; Sun, 9 Feb 2020 05:24:40 +0000 (UTC) Received: by mail-ed1-x52d.google.com with SMTP id c26so4581377eds.8 for ; Sat, 08 Feb 2020 21:26:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:reply-to:from:date:message-id :subject:to:cc; bh=8UH8M6xnaslxFc+b2mgbUBOAIfArjeV1xZQDVerZ0aE=; b=LpjHsT/QH1hB5788MBfG/yThl8sdP4GDzUGpFQGzK9p0rXLqbVd7yIukJNVyYaU27s 4e6imASvAtnZfS6depQ/nibFAhJWXcS4FkgJj9HdkEIzYJTmjBX0JpHjpKvd2iXnBART D4tWmkmb3LxY+Vn19ip8YDVwC9n92tJnxy/QMERdML2okNpTEvqx0se32zoaqH+UbDW4 76jsujeIIeZ8T0XD5MV2LljOu+3DkChIdJLb31INaMVudx11dtmJuqtUN5qwQ7Q0qgEO i3ahqejJGCgEantJoCaLv5013odNwvNUf4nKwgDVLUlr0Q/M9LDPWMFxP2KK1Vdsenh+ gxZg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:reply-to :from:date:message-id:subject:to:cc; bh=8UH8M6xnaslxFc+b2mgbUBOAIfArjeV1xZQDVerZ0aE=; b=cXAcpCDjxM/3oJUOhs70s8LpiMSoxWQ7o6N7lbejvALxp4IYi0yI/tVa6neQY7QcoI jmLT05QYE/N5v0SfiMj7vlKmZVm1fSYNWqyd9x0Sx9qZLkTCG6AZ8nYluic+pJ5UYB1e 6Rjb5BflYq9+iT3yCMSP/sNW/njPHG25KNCg8Hu+ShDpbiyD0ma8e+8k4KrbWUSotoV6 zg+w3epAwILAA49JBytQup9/b6ulPKmGm5nZTbggEpVDZNYgU4lnUiHmJBEKtabosFK8 V++IXyiPlaRT8W+6fpcODq/e6HxdWZ3Oq9/4IQBrx9C1hM8tOBl5Kvv9focYuiuSyAZk xQzA== X-Gm-Message-State: APjAAAUS0iEhbwDR5FhJDWAM2cOOZNvYFhixbf1PcpmtOrbT6+UkDu1J zT49jJh5cE8nnzknZ10KyPMFEKnNIJWAYHrgFw== X-Google-Smtp-Source: APXvYqyVOQWEScGAOTfZmteEHcHVey4jks1vMT/rbwqrIv2H40l1HXWlUfN/MkWJJJJyWzP93MNvTYUFQdJFu/XH9JU= X-Received: by 2002:a17:906:13d9:: with SMTP id g25mr6281830ejc.185.1581225963755; Sat, 08 Feb 2020 21:26:03 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Kunal Shah Date: Sun, 9 Feb 2020 10:55:27 +0530 Message-ID: Subject: Re: wireguard looses internet connection intermittently. To: "Jason A. Donenfeld" X-Mailman-Approved-At: Fri, 14 Feb 2020 11:54:43 +0100 Cc: WireGuard mailing list X-BeenThere: wireguard@lists.zx2c4.com X-Mailman-Version: 2.1.15 Precedence: list Reply-To: kunalv.shah@gmail.com List-Id: Development discussion of WireGuard List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============2560836286708603852==" Errors-To: wireguard-bounces@lists.zx2c4.com Sender: "WireGuard" --===============2560836286708603852== Content-Type: multipart/alternative; boundary="000000000000e11c21059e1ddb70" --000000000000e11c21059e1ddb70 Content-Type: text/plain; charset="UTF-8" Hi Jason, Thanks for your response. After the changes you suggested, It still gives me the same problem. Now my GCP server wireguard configuration looks like this. [Interface] Address = 192.168.1.1 SaveConfig = true PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o ens4 -j MASQUERADEi;iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o ens4 -j MASQUERADE ListenPort = 51840 PrivateKey = MTU=1380 [Peer] PublicKey = AllowedIPs = 192.168.1.2/32 On Sun, 9 Feb 2020 at 03:06, Jason A. Donenfeld wrote: > GCP uses an MTU of 1460 because Google's network does weird things. > That means the MTU for WireGuard should be 1380. On the GCP box, try > adding `MTU=1380` to your config and add this line to PostUp: ` > ; iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -j > TCPMSS --clamp-mss-to-pmtu` > --000000000000e11c21059e1ddb70 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Jason,

Thanks for your response. After= the changes you suggested, It still gives me the same problem. Now my GCP = server wireguard configuration looks like this.

[Interface]
Address= =3D 192.168.1.1
SaveConfig =3D true
PostUp =3D iptables -A FORWARD -= i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POS= TROUTING -o ens4 -j MASQUERADEi;iptables -t mangle -A POSTROUTING -p tcp --= tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
PostDown =3D iptable= s -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables= -t nat -D POSTROUTING -o ens4 -j MASQUERADE
ListenPort =3D 51840
Pri= vateKey =3D <private key>
MTU=3D1380

[Peer]
PublicKey = =3D <public key>
AllowedIPs =3D = 192.168.1.2/32

On Sun, 9 Feb 2020 at 03:06, Jason A. Donenfe= ld <Jason@zx2c4.com> wrote:
GCP uses an MTU of= 1460 because Google's network does weird things.
That means the MTU for WireGuard should be 1380. On the GCP box, try
adding `MTU=3D1380` to your config and add this line to PostUp: `
; iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -j
TCPMSS --clamp-mss-to-pmtu`
--000000000000e11c21059e1ddb70-- --===============2560836286708603852== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ WireGuard mailing list WireGuard@lists.zx2c4.com https://lists.zx2c4.com/mailman/listinfo/wireguard --===============2560836286708603852==--