Skip to content

Fix MTU problem by allowing RELATED fragmentation-needed ICMP #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 2, 2023
Merged

Fix MTU problem by allowing RELATED fragmentation-needed ICMP #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions etc/whonix_firewall.d/30_whonix_gateway_default.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -287,6 +287,14 @@ NO_REJECT_INVALID_OUTGOING_PACKAGES=0
## DISABLED BY DEFAULT
GATEWAY_ALLOW_INCOMING_ICMP=0

## Allow fragmentation-needed ICMP packets to avoid MTU problems
## when Whonix Gateway is connected to a link that has smaller
## MTU than 1500 assumed by Whonix Gateway
## Enable: 1
## Disable: 0
## DISABLED BY DEFAULT
GATEWAY_ALLOW_INCOMING_ICMP_FRAG_NEEDED=0

## Setting firewall_mode always to full by default because the following
## usability issues are not yet resolved. Help welcome!
## Non-Qubes-Whonix: enable sdwdate-gui systray by default
Expand Down
8 changes: 8 additions & 0 deletions etc/whonix_firewall.d/30_whonix_host_default.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,3 +73,11 @@ NO_REJECT_INVALID_OUTGOING_PACKAGES=0
## Disable: 0
## DISABLED BY DEFAULT
GATEWAY_ALLOW_INCOMING_ICMP=0

## Allow fragmentation-needed ICMP packets to avoid MTU problems
## when Whonix Gateway is connected to a link that has smaller
## MTU than 1500 assumed by Whonix Gateway
## Enable: 1
## Disable: 0
## DISABLED BY DEFAULT
GATEWAY_ALLOW_INCOMING_ICMP_FRAG_NEEDED=0
7 changes: 7 additions & 0 deletions usr/bin/whonix-gateway-firewall
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -388,6 +388,13 @@ ipv4_input_rules() {
$iptables_cmd -A INPUT -m state --state ESTABLISHED -j ACCEPT
fi

## Allow fragmentation-needed ICMP packets to avoid MTU problems
## when Whonix Gateway is connected to a link that has smaller
## MTU than 1500 assumed by Whonix Gateway
if [ "$GATEWAY_ALLOW_INCOMING_ICMP_FRAG_NEEDED" = "1" ]; then
$iptables_cmd -A INPUT -p icmp --icmp-type fragmentation-needed -m state --state RELATED -j ACCEPT
fi

## Drop all incoming ICMP traffic by default.
## All incoming connections are dropped by default anyway, but should a user
## allow incoming ports (such as for incoming SSH or FlashProxy), ICMP should
Expand Down
11 changes: 10 additions & 1 deletion usr/bin/whonix-gateway-firewall.nftables
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,8 @@ variables_defaults() {
[ -n "$ALLOW_GATEWAY_USER_USER" ] || ALLOW_GATEWAY_USER_USER=0
[ -n "$GATEWAY_ALLOW_INCOMING_SSH" ] || GATEWAY_ALLOW_INCOMING_SSH=0
[ -n "$GATEWAY_ALLOW_INCOMING_ICMP" ] || GATEWAY_ALLOW_INCOMING_ICMP=0

[ -n "$GATEWAY_ALLOW_INCOMING_ICMP_FRAG_NEEDED" ] || GATEWAY_ALLOW_INCOMING_ICMP_FRAG_NEEDED=0

## Get Tor username, distro specific!
[ -n "$TOR_USER" ] || TOR_USER="$(id -u debian-tor)"

Expand Down Expand Up @@ -439,6 +440,14 @@ nft_input_rules() {
$nftables_cmd add rule ip filter INPUT ct state established counter accept
fi

## Allow fragmentation-needed ICMP packets to avoid MTU problems
## when Whonix Gateway is connected to a link that has smaller
## MTU than 1500 assumed by Whonix Gateway
if [ "$GATEWAY_ALLOW_INCOMING_ICMP_FRAG_NEEDED" = "1" ]; then
#$iptables_cmd -A INPUT -p icmp --icmp-type fragmentation-needed -m state --state RELATED -j ACCEPT
$nftables_cmd add rule filter INPUT icmp type destination-unreachable icmp code frag-needed ct state related counter accept
fi

## Drop all incoming ICMP traffic by default.
## All incoming connections are dropped by default anyway, but should a user
## allow incoming ports (such as for incoming SSH or FlashProxy), ICMP should
Expand Down
7 changes: 7 additions & 0 deletions usr/bin/whonix-host-firewall
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,6 +147,13 @@ iptables -A INPUT -i lo -j ACCEPT
## Established incoming connections are accepted.
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

## Allow fragmentation-needed ICMP packets to avoid MTU problems
## when Whonix Gateway is connected to a link that has smaller
## MTU than 1500 assumed by Whonix Gateway
if [ "$GATEWAY_ALLOW_INCOMING_ICMP_FRAG_NEEDED" = "1" ]; then
iptables -A INPUT -p icmp --icmp-type fragmentation-needed -m state --state RELATED -j ACCEPT
fi

## Drop all incoming ICMP traffic by default.
## All incoming connections are dropped by default anyway, but should a user
## allow incoming ports (such as for incoming SSH or FlashProxy), ICMP should
Expand Down