diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-02 00:52:41 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-02 00:52:49 +0900 |
| commit | 8f0380a933f420320716de61a5838400117dbb8a (patch) | |
| tree | fff5306678598e1bdd0d8c4eae29a17ffb0a4ac2 | |
| parent | f6f06e6aa292110bf774fa1ff4591c288b275305 (diff) | |
Disable IKE fragmentation, use IP-level fragmentation for iOS
iOS may have a bug where it advertises N(FRAG_SUP) but fails to reassemble
IKE fragments in IKE_AUTH responses. Switching to fragmentation=no forces
the large IKE_AUTH response to be sent as a single UDP packet with IP-level
fragmentation, which iOS's standard IP stack handles correctly.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
| -rw-r--r-- | vpn/strongswan.conf | 2 | ||||
| -rw-r--r-- | vpn/swanctl.conf.tpl | 1 |
2 files changed, 2 insertions, 1 deletions
diff --git a/vpn/strongswan.conf b/vpn/strongswan.conf index 4c04b41..d3a7f93 100644 --- a/vpn/strongswan.conf +++ b/vpn/strongswan.conf @@ -1,6 +1,6 @@ charon { load_modular = yes - fragment_size = 512 + plugins { include strongswan.d/charon/*.conf } diff --git a/vpn/swanctl.conf.tpl b/vpn/swanctl.conf.tpl index da988e0..1fc84df 100644 --- a/vpn/swanctl.conf.tpl +++ b/vpn/swanctl.conf.tpl @@ -1,6 +1,7 @@ connections { ikev2-eap { version = 2 + fragmentation = no # iOS/macOS/Android 互換の暗号スイート proposals = aes256gcm16-prfsha256-ecp256,aes256-sha256-ecp256,aes256gcm16-prfsha384-ecp384,aes256-sha256-modp2048,aes256-sha1-modp2048 |