diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-01 13:24:22 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-01 13:24:22 +0900 |
| commit | 5a7b068b67bfe623f6bc1a62dcddfca2535c3a46 (patch) | |
| tree | 44bb575dcd87556fe957a1bb2a34f487497997da /vpn/strongswan.conf | |
| parent | 75686581d208ba4b4263420db169f56083dda52b (diff) | |
Fix IKE fragmentation: use fragmentation=no instead of fragment_size=0
fragment_size=0 was interpreted as minimum fragment size (resulting in
4 tiny fragments), not disabled. fragmentation=no in swanctl.conf is
the correct per-connection setting to disable IKE fragmentation entirely.
The server now sends a single large UDP packet; the OS kernel handles
IP fragmentation instead of the IKE layer.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Diffstat (limited to 'vpn/strongswan.conf')
| -rw-r--r-- | vpn/strongswan.conf | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/vpn/strongswan.conf b/vpn/strongswan.conf index e2543a5..eeed46c 100644 --- a/vpn/strongswan.conf +++ b/vpn/strongswan.conf @@ -12,6 +12,5 @@ charon { } } send_vendor_id = no - fragment_size = 0 } include strongswan.d/*.conf |