diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-01 12:30:02 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-01 12:30:02 +0900 |
| commit | 75686581d208ba4b4263420db169f56083dda52b (patch) | |
| tree | 51c1111cc919f890b4d2ca585b13f18e6045369a | |
| parent | 47e47957cc363511d1de5f78caff7ff77ed7d0c7 (diff) | |
Restore intermediate CA cert, disable IKE fragmentation
Android (XREAL Beam Pro) fails to reassemble IKE fragments even though
FRAG_SUP is negotiated. IP-level fragmentation (handled by the OS kernel)
works better. Removing the intermediate cert broke macOS/iOS.
This config:
- Sends leaf cert + YE1 intermediate (so any client can verify the chain)
- fragment_size=0 disables IKE fragmentation; the 1776-byte IKE_AUTH
response is sent as one large UDP packet (OS handles IP fragmentation)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
| -rw-r--r-- | vpn/docker-compose.yml | 1 | ||||
| -rw-r--r-- | vpn/strongswan.conf | 1 |
2 files changed, 2 insertions, 0 deletions
diff --git a/vpn/docker-compose.yml b/vpn/docker-compose.yml index 83ff270..1961a99 100644 --- a/vpn/docker-compose.yml +++ b/vpn/docker-compose.yml @@ -8,6 +8,7 @@ services: - SYS_MODULE volumes: - ./certs/server.crt:/etc/swanctl/x509/server.crt:ro + - ./certs/server-chain.crt:/etc/swanctl/x509ca/server-chain.crt:ro - ./certs/server.key:/etc/swanctl/private/server.key:ro - ./users.conf:/etc/strongswan/users.conf:ro environment: diff --git a/vpn/strongswan.conf b/vpn/strongswan.conf index eeed46c..e2543a5 100644 --- a/vpn/strongswan.conf +++ b/vpn/strongswan.conf @@ -12,5 +12,6 @@ charon { } } send_vendor_id = no + fragment_size = 0 } include strongswan.d/*.conf |